Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Kadence Memberships Plugin for WordPress: Password Reset Link Poisoning

CVE-2026-9273 · published 1 month ago
Summary

A security issue in the Kadence Memberships plugin for WordPress allows attackers to take control of any account, including administrator accounts, by sending a fake password reset link. This can happen if an attacker tricks someone into clicking on a malicious link. To protect your site, update the Kadence Memberships plugin to the latest version or consider removing the plugin if you're not using it.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
stellarwp membership plugin – kadence memberships <= 4.0.0
Original advisory text
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and in...
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-640Weak Password Recovery Mechanism for Forgotten Password
Timeline
Published5 Aug 2026
Updated1 Oct 2026
First seen5 Aug 2026
Sources
CVE-2026-9273 · NVD
CVE-2026-9273 · MITRE
Track software like this
Free during beta