CVE-2026-9273
Received Received - Intake

Password Reset Link Poisoning in Kadence Memberships WordPress Plugin

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Wordfence

Description
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-9273
EUVD
EUVD-2026-53042

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
kadence membership_plugin to 4.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Kadence Memberships WordPress plugin allows attackers to poison password reset links. It exploits unvalidated user input in the rc_redirect parameter to redirect victims to attacker-controlled sites while stealing their password reset tokens. The flaw exists in legacy code handling password resets, enabling unauthenticated attackers to initiate reset requests for any account, including administrators.

Detection Guidance

Check WordPress sites using the Membership Plugin – Kadence Memberships for versions up to 4.0.0. Inspect server logs for unusual password reset requests or redirects to external domains. Look for POST requests containing rc_redirect parameter in legacy/includes/forms.php.

Impact Analysis

If you use the Kadence Memberships plugin version 4.0.0 or earlier, attackers could take over your WordPress account, including admin accounts. This could lead to unauthorized access to your site, data theft, or complete site compromise. Regular users might have their accounts hijacked, while admins could lose control of the entire site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using this plugin may face compliance violations, regulatory fines, and reputational damage if user data is compromised through account takeover attacks.

Mitigation Strategies

Update the Membership Plugin – Kadence Memberships to the latest version beyond 4.0.0. Disable the legacy lost-password handler if possible. Implement input validation for rc_redirect parameter and restrict redirects to trusted domains.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart