{"id":"CVE-2026-88785","revision":"e90175d8a38146919ef942e281e42d27","records":[{"revision":"e90175d8a38146919ef942e281e42d27","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-88785","aliases":[],"title":"Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query String","description":"The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL query string when an optional auto-login-after-registration feature is enabled, exposing the credential in browser history and in web server, proxy, and CDN access logs to anyone able to read them.","state":0,"publishedAt":"2026-10-11T06:00:15.724+00:00","modifiedAt":"2026-10-11T11:32:43.112+00:00","affected":[{"ecosystem":"Vendor product","name":"Simple Membership","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Simple Membership\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.8.3\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/7d9a6fe5-fcfc-48f0-a811-8623a69422df/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-88785","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-88785","identifiers":["CVE-2026-88785"]},"retained":false,"historicalAffected":[]}],"coverage":[]}