CVE-2026-9273: Password Reset Link Poisoning in Kadence Memberships
TL;DR - Critical unauthenticated flaw in Membership Plugin – Kadence Memberships through 4.0.0. - Attackers can poison password reset links and capture valid reset tokens for account takeover. - Upgrade to 4.0.1 immediately and review password reset activity.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-9273 |
| CVSS | 9.3 |
| Attack vector | Network |
| Privileges required | None |
| Patch available | Yes, fixed in 4.0.1 |
This issue affects the WordPress plugin Membership Plugin – Kadence Memberships from Nexcess, formerly known as Restrict Content. The vulnerability is notable because it does not require authentication and can be used to target arbitrary users, including administrators, by abusing the plugin’s password reset flow.
From a defender perspective, this is not just an open redirect or phishing nuisance. The risk is account takeover. The poisoned email contains a legitimate reset key and login pair, but the URL base can be attacker-controlled. If the user clicks the link, the attacker can capture the reset material and replay it against the real WordPress site.
What Is This Vulnerability?
CVE-2026-9273 is a password reset link poisoning vulnerability in the plugin’s legacy lost-password workflow. According to the NVD description, the vulnerable handler is rc_process_lost_password_form(), and it consumes an attacker-controlled rc_redirect POST parameter. That value is then used in sensitive operations without proper validation.
The NVD description identifies two problematic sinks in legacy/includes/forms.php for version 4.0.0: a redirect call using wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) and reset-link construction using add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email(). The result is that an attacker can cause the plugin to generate a password reset email whose link points to an attacker-controlled host while still embedding a valid reset token and login.
This matters because the vulnerability turns a normal password recovery process into a token exfiltration path. The victim receives what appears to be a standard password reset message. If they click the link, they may land on a domain controlled by the attacker, leaking the reset key. The attacker can then reuse that key against the legitimate WordPress instance to complete a password reset and seize the account.
A further enabler is that the nonce required to reach the vulnerable handler is not meaningfully protected from anonymous access. The research note states that the nonce is exposed via the public [login_form] shortcode, allowing unauthenticated attackers to gather the necessary form data and trigger the workflow.
Technical Notes
The vulnerable behavior, as described by NVD, centers on these code paths:
// Reported sink at legacy/includes/forms.php line 243
wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... );
// Reported sink at legacy/includes/forms.php line 306
add_query_arg(
array(
'key' => $key,
'login' => ...
),
$_POST['rc_redirect']
);
A simplified attack flow looks like this:
1. Request public login form page containing [login_form]
2. Extract nonce from page/form
3. Submit lost-password request for target user
4. Supply attacker-controlled rc_redirect value
5. Victim receives reset email with poisoned host
6. Victim clicks link
7. Attacker captures reset key/login
8. Attacker replays token on legitimate site
Who Is Affected?
The affected product is Membership Plugin – Kadence Memberships, formerly Restrict Content, published on WordPress.org by Nexcess. Based on the available research and the official plugin page evidence cited, the affected range is all versions up to and including 4.0.0.
The fixed version is 4.0.1. The plugin changelog reportedly includes the entry “Security: Strengthened security measures for password recovery.” While that changelog line is brief, it aligns closely with the documented flaw and is the strongest official ecosystem evidence provided for the remediation release.
If you run this plugin on any internet-accessible WordPress site and the installed version is "4.0.0" or any earlier release in that branch, you should assume exposure. This is especially important for sites where password reset flows are publicly reachable and where administrator or privileged user email addresses are likely to receive unsolicited reset messages.
If you are unsure whether the plugin is installed, do not rely solely on the current branding. Older documentation, asset paths, or operational notes may still refer to it as Restrict Content. Asset paths, directory names, or plugin slugs may still reflect that older naming in some environments.
Technical Notes
You can verify the installed plugin version from WordPress CLI:
wp plugin list | grep -i "restrict-content\|kadence memberships"
Or inspect the plugin metadata directly on disk:
grep -E "Version:" wp-content/plugins/restrict-content/*.php
Defenders should treat the following as affected unless verified otherwise:
Product: Membership Plugin – Kadence Memberships
Former name: Restrict Content
Affected versions: <= 4.0.0
Fixed version: 4.0.1
CVSS Score Breakdown
The reported CVSS v3.x base score is 9.3, which places this flaw in the critical category. The exact vector string was not available in the research note, so defenders should avoid assuming undocumented values for each metric. Still, the score aligns with what practitioners would expect from an unauthenticated, internet-reachable account takeover path.
A score this high suggests a combination of factors such as remote exploitability, no required privileges, and high impact to confidentiality and integrity. In practical terms, compromise of an administrator account in WordPress often leads to full site control, malicious plugin installation, content tampering, credential theft, and follow-on compromise of connected systems or users.
Because the exact NVD vector string was not included, the safest operational assumption is to treat this as a high-likelihood, high-impact issue that can be exploited over the network without prior access. The absence of a published vector string in your internal notes should not delay remediation.
The business impact is also disproportionate for many SMB and membership-driven sites. A successful takeover can expose member records, payment-related workflows, private content, and email trust. Even when only a non-admin account is targeted, password reset poisoning can still lead to lateral abuse if the user has elevated plugin or commerce privileges.
Technical Notes
Where the vector details are unknown, document the known facts rather than filling gaps with guesses:
Known:
- CVSS v3.x base score: 9.3
- Unauthenticated attack path
- Remote exploitation over HTTP(S)
- Account takeover impact
Unknown from available data:
- Exact published CVSS vector string
Exploitation Status
At the time of the provided research, active exploitation in the wild is not confirmed. Specifically, the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, which means there is no CISA-confirmed exploitation entry available from that source.
There is also no verified public GitHub proof of concept identified in the research note. That said, the lack of a public PoC should not be interpreted as low risk. The NVD description contains enough technical detail, including function names, parameter names, file paths, and line references, that a capable attacker or researcher could likely reproduce the issue without much difficulty.
So the practical status is: no confirmed in-the-wild exploitation from the cited sources, no verified public PoC found, but exploitation appears feasible based on the published technical description. Defenders should respond as if weaponization is straightforward, especially because the attack does not require authentication and targets a familiar workflow that users may trust.
In environments with exposed login or lost-password pages, the main barrier to exploitation is user interaction with the poisoned reset email. That still leaves a meaningful attack window, particularly for admins or staff who may react quickly to unexpected reset prompts.
Technical Notes
Operationally, track status in three buckets:
Public PoC: None verified from provided research
In-the-wild exploitation: Not confirmed by CISA KEV
Exploitability assessment: High, due to detailed NVD description and no-auth attack path
How to Detect It
Detection should focus on abnormal password reset activity and indicators that the plugin’s lost-password workflow is being invoked with suspicious redirect values. Because this issue abuses an application-layer parameter, web logs, reverse proxy logs, WAF telemetry, and email security tools are your best immediate data sources.
Start by looking for spikes in password reset requests, especially those targeting privileged accounts, and then correlate those events with unusual POST parameters containing full external URLs. Any request that includes an rc_redirect value pointing to a non-local domain should be considered suspicious. Even if exploitation has not been confirmed, this is a concrete indicator aligned to the published root cause.
You should also review mail logs and user reports for reset emails that contain unexpected domains. If a user received a password reset email where the link host does not match the legitimate WordPress site, treat that as a potential incident. Because successful exploitation depends on link-click token capture, proxy logs and DNS logs for outbound connections to suspicious domains shortly after reset emails are sent may provide useful corroboration.
If you have endpoint telemetry or browser isolation logs for administrators, pivot on recent visits to domains embedded in password reset messages. In many cases, the earliest sign may be user confusion about a password reset they did not request, followed by login anomalies or a sudden password change.
Technical Notes
Example web log hunting patterns:
POST requests to lost-password endpoints containing:
- rc_redirect=http://
- rc_redirect=https://
- rc_redirect with host not matching your WordPress site
Example grep against HTTP access logs:
grep -Ei 'rc_redirect=.*https?%3A|rc_redirect=.*https?://' /var/log/nginx/access.log
Example Splunk query:
index=web sourcetype=nginx_access OR sourcetype=apache_access
("rc_redirect=" AND ("lostpassword" OR "reset" OR "login_form"))
| rex field=_raw "rc_redirect=(?<rc_redirect>[^& ]+)"
| stats count values(rc_redirect) by src_ip, http_user_agent, uri_path
Example Sigma-style detection logic concept:
title: Suspicious WordPress rc_redirect Password Reset Abuse
logsource:
category: webserver
detection:
selection:
request_method: POST
cs-uri-query|contains: "rc_redirect="
keywords:
- "lostpassword"
- "login_form"
condition: selection and keywords
level: high
Network and content inspection idea for outbound email or web telemetry:
Flag password reset URLs where:
- email subject/body indicates reset
- URL contains key= and login=
- host does not equal the organization’s WordPress domain
Mitigation and Patching
The primary mitigation is to upgrade to version 4.0.1 of the plugin. Based on the provided evidence, all versions up to and including 4.0.0 are affected, and 4.0.1 is the fixed release. If you run an older version, patching should be prioritized ahead of routine maintenance windows because the vulnerability is unauthenticated and can lead to administrator takeover.
After patching, review recent password reset events, particularly for administrative and editor-level accounts. If you suspect exploitation, force password resets for affected users, invalidate active sessions, and inspect for persistence such as unauthorized admin users, newly installed plugins, modified theme files, or malicious scheduled tasks. If a reset link may have been clicked before patching, do not assume the account is safe simply because the plugin is now updated.
Where immediate patching is not possible, reduce exposure by temporarily disabling public password reset functionality if operationally acceptable, restricting access to login and reset endpoints behind a VPN or allowlist, and monitoring for rc_redirect abuse. A WAF rule that blocks external absolute URLs in the rc_redirect parameter can help as an interim control, but it is not a substitute for upgrading.
If your site relies heavily on public logins and self-service password recovery, test the patch quickly in staging and deploy as soon as possible. The attack path is simple enough that delay increases risk even without public exploitation reporting.
Technical Notes
Upgrade with WordPress CLI:
wp plugin update restrict-content --version=4.0.1
If the plugin slug differs in your environment, list installed plugins first:
wp plugin list
Temporary mitigation at the reverse proxy or WAF layer can block external rc_redirect values. Example NGINX concept:
if ($request_method = POST) {
if ($args ~* "rc_redirect=https?://") {
return 403;
}
}
For POST body inspection, use your WAF or ModSecurity rather than relying only on query-string checks. Example ModSecurity concept:
SecRule REQUEST_BODY "rc_redirect=https?://" \
"id:1009273,phase:2,deny,status:403,msg:'Blocked external rc_redirect in password reset flow'"
Incident response steps if abuse is suspected:
# Force password reset for high-risk users through WP-CLI workflow or admin process
# Then invalidate sessions
wp user session destroy --all
And manually inspect for common takeover artifacts:
wp user list --role=administrator
wp plugin list
wp theme list
find wp-content/uploads -type f -name "*.php"
References
The primary technical description comes from the NVD record summarized in the provided research note. That source identifies the vulnerable handler, the attacker-controlled parameter, the affected file path, and the relevant line references in the WordPress Plugin Trac code browser for the 4.0.0 tag and trunk.
The official WordPress.org plugin page was used in the research to confirm the product naming, vendor attribution to Nexcess, current version visibility, and the changelog language indicating that 4.0.1 strengthened password recovery security. Because direct retrieval of some Trac pages returned access limitations in the research environment, the code-level specifics cited here are based on the NVD description as provided.
Use these references for validation and change-control documentation:
- NVD entry for CVE-2026-9273
- WordPress Plugin Trac references for
legacy/includes/forms.phpline contexts cited by NVD - Official WordPress.org plugin page for Membership Plugin – Kadence Memberships / Restrict Content
- CISA Known Exploited Vulnerabilities catalog lookup for CVE-2026-9273
For further reading on password security and related vulnerabilities, check our articles on What is a Passkey? and Evil Twin Attack.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.