{"id":"CVE-2026-88785","aliases":["EUVD-2026-96773","GHSA-vv5r-wf9f-5j7m"],"status":"published","title":"Simple Membership \u003c 4.8.3 - Newly Registered Member Password Disclosure via URL Query String","description":"The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0009,"percentile":0.00411,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-10-11T06:00:15Z","modified":"2026-10-13T20:36:00Z","products":[{"vendor":"unknown","product":"simple membership"},{"vendor":"wpinsider-1","product":"simple membership"}],"references":[{"url":"https://wpscan.com/vulnerability/7d9a6fe5-fcfc-48f0-a811-8623a69422df/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88785"},{"url":"https://wpscan.com/vulnerability/7d9a6fe5-fcfc-48f0-a811-8623a69422df"},{"url":"https://github.com/advisories/GHSA-vv5r-wf9f-5j7m"}],"sources":{"cve":[{"id":"CVE-2026-88785","title":"Simple Membership \u003c 4.8.3 - Newly Registered Member Password Disclosure via URL Query String","description":"The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.","status":"published","published":"2026-10-11T06:00:15.724Z","modified":"2026-10-11T11:32:43.112Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:41:53.237769Z"}],"euvd":[{"id":"EUVD-2026-96773","description":"The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.","status":"published","published":"2026-10-11T06:00:15Z","modified":"2026-10-11T11:32:43Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:23.217739Z"}],"ghsa":[{"id":"GHSA-vv5r-wf9f-5j7m","title":"The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly...","description":"The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.","status":"published","published":"2026-10-11T09:30:25Z","modified":"2026-10-11T12:31:09Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:13:04.632316Z"}],"nvd":[{"id":"CVE-2026-88785","description":"The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.","status":"published","published":"2026-10-11T07:17:27.03Z","modified":"2026-10-13T20:36:00.85Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:55.874869Z"}]}}