Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-4136: Membership Plugin for WordPress allows attackers to redirect users to malicious sites
CVE-2026-4136 · published 7 months ago
Summary
The Membership Plugin for WordPress is open to an attack that can trick users into visiting fake websites. This is due to a weakness in the plugin's handling of links in password reset emails. To fix this, update the plugin to the latest version, which includes a patch for this issue.
Original advisory text
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due to insufficient validation on the redir...
The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due to insufficient validation on the redirect url supplied via the 'rcp_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-640Weak Password Recovery Mechanism for Forgotten Password
Timeline
Published20 Mar 2026
Updated29 Oct 2026
First seen20 Mar 2026
Sources
CVE-2026-4136 · NVD
Track software like this
Free during beta