Plaintext Password Exposure in Simple Membership Plugin by WordPress
CVE-2026-88785
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-88785?
The Simple Membership plugin for WordPress has a security flaw where, when the auto-login feature is enabled after registration, it transmits the newly registered member's plaintext password in the URL query string. This can lead to exposure of sensitive credentials in browser history, web server logs, proxies, and CDNs, making it accessible to unauthorized users. It is critical for website administrators to update to version 4.8.3 or later to mitigate this risk.
Affected Version(s)
Simple Membership 0 < 4.8.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.