A critical (CVSS 9.3) flaw in the WordPress "Membership Plugin – Kadence Memberships" (formerly Restrict Content) lets unauthenticated attackers poison password reset emails and hijack any account, including administrators.
What Is It
CVE-2026-9273 is a password reset link poisoning issue (CWE-640) in the plugin's legacy lost-password handler, rc_process_lost_password_form(). The handler consumes the attacker-controlled rc_redirect POST parameter and passes it into two unvalidated sinks in legacy/includes/forms.php:
wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... )at line 243add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] )insiderc_send_password_reset_email()at line 306
The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor, so there is no authentication barrier in front of the bug.
Why It Matters
An unauthenticated attacker can issue a password reset request for any account on the site, administrators included, and the resulting reset email points the victim at an attacker-controlled host while carrying a valid reset key and login. When the victim clicks the link, the reset key leaks to the attacker, who replays it against the legitimate site to complete account takeover.
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N: network-reachable, low complexity, no privileges required, scope changed, with high confidentiality and integrity impact. User interaction is required, the victim must click the poisoned link, which is the only meaningful friction in the chain.
No CISA KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation at this time.
What's Vulnerable
- Vendor: stellarwp
- Product: Membership Plugin – Kadence Memberships (formerly Restrict Content)
- Affected versions: all versions up to and including 4.0.0
Sites using the public [login_form] shortcode are directly exposed, since that shortcode is what leaks the required nonce.
Patch Status
A changeset between tags 4.0.0 and 4.0.1 is published in the WordPress plugin repository, indicating 4.0.1 as the fixed release. Operators running 4.0.0 or earlier should update to 4.0.1. No CISA KEV due date or required action was supplied.
Sources
- NVD, CVE-2026-9273 (source: [email protected]), published 2026-08-05
- Wordfence Threat Intel entry
- WordPress Plugin Trac; forms.php line 207 (tag 4.0.0)
- WordPress Plugin Trac; forms.php line 243 (tag 4.0.0)
- WordPress Plugin Trac; forms.php line 306 (tag 4.0.0)
- WordPress Plugin Trac; changeset 4.0.0 → 4.0.1