WordPress security changelog
CRITICAL CVE-2026-9273 Deferred

Kadence Memberships reset redirect can leak administrator reset keys

Membership Plugin – Kadence Memberships through 4.0.0 lets an unauthenticated visitor obtain the nonce exposed by the public [login_form] shortcode and submit an attacker-controlled rc_redirect value to rc_process_lost_password_form(). The legacy handler carries that value into wp_redirect() and into add_query_arg() in rc_send_password_reset_email(), causing the target user's legitimate reset email to point at an attacker-controlled host. If the victim follows that link, the valid reset key and login leak to the attacker, who can replay them against the real site and take over the account, including an administrator account.

CVE / CNA score 9.3 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Membership Plugin – Kadence Memberships
Plugin slug
restrict-content
Affected
<= 4.0.0
Safe version
4.0.1
Published
Aug 05, 2026
Weakness
CWE-640 — Weak Password Recovery Mechanism for Forgotten Password

This CVE was published Aug 05, 2026 and is one of 11 known issues for this plugin.

What to do

Update, patch or deactivate.

Update Membership Plugin – Kadence Memberships to 4.0.1 or later. Version 4.0.1 is the first fixed tag identified by the upstream changeset. Review password-reset activity and administrator accounts if the public login shortcode was available on a vulnerable site.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

References

Primary and upstream sources