4.7
Medium
CVE-2026-88785 The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext…
Description
The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Simple Membership 4.8 | earliest → < 4.8.3 | 4.8.3 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of Simple Membership
The 12 CVEs of Simple Membership →
CVE-2026-88764
The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal…
5.4
Medium
CVE-2026-14936
The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the…
5.3
Medium
CVE-2026-15931
The Simple Membership WordPress plugin before 4.7.8 does not sanitise a subscriber name value received from an…
6.1
Medium
CVE-2026-15930
The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration…
9.4
Critical