Simple Membership EUVD-2026-96773

Exploitation requires that the plugin's OPTIONAL auto-login-after-registration feature be explicitly enabled - this is not the default, and sites that never turn it on are unaffected. When enabled, a new member's plaintext password is placed in a URL query string during registration. To actually obtain the credential, the attacker must be able to READ one of the exposure sinks named in the description: browser history (local access to the registrant's machine/shared browser) or web server, reverse-proxy, or CDN access logs (privileged log-read access). Limiting factors: the vulnerable code path only triggers for newly registered accounts while the feature is active, only confidentiality is affected (no integrity/availability impact), and there is no remote unauthenticated network path to the credential - the attacker needs local or privileged access to the log/history store.

This is a genuine-but-low-priority information-disclosure issue, not a high-urgency flaw. The provided CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N = 4.7, Medium) is internally consistent with the description: the password is not leaked over the network to an anonymous remote attacker, but rather deposited into locations (browser history, web server/proxy/CDN access logs) that require local or privileged read access to harvest - hence AV:L and PR:L. AC:H reflects that exploitation is contingent on a non-default optional feature (auto-login-after-registration) being enabled. The C:H rating is defensible because a cleartext password is a high-value credential, though impact is confined to confidentiality (I:N/A:N). Signals are partially missing: no EPSS score and no SSVC decision data were supplied, so automatability and exploitation-maturity cannot be weighed quantitatively. POC/exploit code is publicly available (WPScan) but the vulnerability is NOT in CISA KEV and there is no evidence of active exploitation - do not conflate public POC with in-the-wild use. Net: a real hygiene/credential-exposure bug worth patching, but the local/privileged access requirement and dependency on an optional setting keep real-world risk modest despite the C:H component.

A site operator enables the optional auto-login-after-registration feature; thereafter each new member's plaintext password is appended to a URL query string during registration. An attacker with read access to the web server, reverse-proxy, or CDN access logs (or to a shared/kiosk browser's history) later recovers those cleartext credentials and reuses them to authenticate as the affected members. Public POC/detail exists via WPScan, lowering the effort to recognize and locate the exposed parameter.