CVE-2026-9273 in Kadence Memberships Plugin
Summary
by MITRE • 08/05/2026
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The Kadence Memberships plugin for WordPress presents a critical account takeover vulnerability through password reset link poisoning that affects all versions up to and including 4.0.0. This vulnerability stems from improper input validation within the legacy lost-password handler function rc_process_lost_password_form() which processes attacker-controlled data from the rc_redirect POST parameter without adequate sanitization or validation. The flaw manifests in two distinct code paths within legacy/includes/forms.php where unvalidated user input flows directly into critical system functions. The first sink occurs at line 243 where wp_redirect( esc_url( $_POST['rc_redirect'] ) ) processes the redirect parameter, while the second sink appears at line 306 within rc_send_password_reset_email() where add_query_arg() incorporates the unvalidated rc_redirect value into password reset email URLs. Both sinks represent CWE-116 improper input sanitization vulnerabilities that allow attackers to manipulate the redirection behavior during password reset operations.
The operational impact of this vulnerability is severe as it eliminates the need for authentication to exploit the flaw entirely. The nonce required to access the vulnerable handler is publicly broadcast through the [login_form] shortcode at line 207, making it accessible to any anonymous visitor without prior authentication. This design flaw creates an attack surface where unauthenticated adversaries can systematically target any user account including high-privilege administrator accounts by initiating password reset requests. The vulnerability operates under the ATT&CK framework as a credential access technique leveraging weak session management and improper input validation. When victims receive password reset emails containing links pointing to attacker-controlled domains, they unknowingly leak their reset tokens to malicious actors who can then replay these tokens against legitimate sites to assume control of compromised accounts.
The attack chain begins with an anonymous user triggering a password reset request for any target account through the publicly accessible login form shortcode. The system generates a valid reset key and login pair that gets embedded into a password reset email sent to the victim's registered address. However, due to the lack of validation in the redirect parameter handling, attackers can manipulate the email content to point victims toward domains they control rather than the legitimate site. When victims click these poisoned links, their reset keys become visible to attackers who can then complete the account takeover process by replaying the stolen tokens against the original WordPress installation. This vulnerability directly violates security principles related to input validation and session management, creating a persistent threat that can be exploited across all plugin versions up to 4.0.0. The remediation requires immediate patching of the vulnerable code paths to implement proper input sanitization and validation of redirect parameters before they are processed by system functions like wp_redirect() and add_query_arg(). Organizations should also consider implementing additional security controls such as email domain verification for password reset operations and monitoring for unusual authentication patterns that might indicate account takeover attempts.