CVE-2026-4136: WordPress Membership Plugin Redirect Flaw

CVE-2026-4136 Overview

The Membership Plugin – Restrict Content plugin for WordPress contains an Unvalidated Redirect vulnerability in all versions up to and including 3.2.24. This security flaw stems from insufficient validation on the redirect URL supplied via the rcp_redirect parameter. The vulnerability allows unauthenticated attackers to redirect users who receive password reset emails to potentially malicious sites, provided they can successfully trick users into performing an action.

Critical Impact

Unauthenticated attackers can exploit this vulnerability to redirect WordPress users to malicious sites through manipulated password reset emails, potentially leading to credential theft, phishing attacks, or malware distribution.

Affected Products

• Membership Plugin – Restrict Content for WordPress versions up to and including 3.2.24
• WordPress sites using the Restrict Content plugin with password reset functionality enabled
• Any WordPress deployment utilizing the vulnerable rcp_redirect parameter

Discovery Timeline

• 2026-03-20 - CVE-2026-4136 published to NVD
• 2026-03-20 - Last updated in NVD database

Technical Details for CVE-2026-4136

Vulnerability Analysis

This vulnerability is classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). The flaw exists in the login functions of the Restrict Content plugin, specifically in how the plugin handles redirect URLs during the password reset flow.

When a user initiates a password reset, the plugin accepts a rcp_redirect parameter that specifies where the user should be redirected after completing the password reset process. Due to insufficient validation of this parameter, an attacker can craft a malicious password reset link containing an arbitrary external URL, which the plugin will use to redirect the user without proper verification.

The vulnerability requires user interaction—victims must click on a crafted link, typically distributed through phishing emails or social engineering—but does not require any authentication or special privileges to exploit.

Root Cause

The root cause of this vulnerability is the lack of proper URL validation in the login-functions.php file at line 270. The plugin fails to verify that the redirect destination belongs to the same domain or is on an approved whitelist before performing the redirect. This allows attackers to specify arbitrary external URLs, enabling open redirect attacks during the password reset workflow.

For technical details on the vulnerable code, see the WordPress Login Functions Code.

Attack Vector

The attack vector is network-based and exploits the password reset email mechanism. An attacker can craft a malicious URL containing the rcp_redirect parameter pointing to an attacker-controlled site. This URL can be embedded in phishing emails or distributed through other social engineering channels.

When a victim clicks the link and completes the password reset process, they are automatically redirected to the malicious site. The attacker can then present a fake login page to harvest credentials, serve malware, or conduct other malicious activities while appearing to originate from a trusted source.

The vulnerability requires user interaction (clicking a malicious link) but no authentication, making it exploitable by any unauthenticated attacker who can deliver the crafted URL to potential victims.

Detection Methods for CVE-2026-4136

Indicators of Compromise

• Unusual redirect URLs in password reset links containing external domains in the rcp_redirect parameter
• Web server logs showing password reset requests with suspicious or malformed rcp_redirect values pointing to external sites
• User reports of being redirected to unexpected websites after clicking password reset links

Detection Strategies

• Monitor web server access logs for requests to password reset endpoints containing the rcp_redirect parameter with external URLs
• Implement web application firewall (WAF) rules to detect and block requests with suspicious redirect parameters
• Review email gateway logs for outbound password reset emails that may have been triggered by automated attacks

Monitoring Recommendations

• Configure real-time alerting for password reset requests containing redirect parameters pointing to domains outside your organization
• Enable detailed logging for all authentication-related plugin functions
• Deploy SentinelOne Singularity to monitor WordPress application behavior and detect anomalous redirect patterns

How to Mitigate CVE-2026-4136

Immediate Actions Required

• Update the Membership Plugin – Restrict Content to version 3.2.25 or later immediately
• Review web server logs for any evidence of exploitation attempts targeting the rcp_redirect parameter
• Notify users to be cautious of password reset emails and verify destination URLs before entering credentials

Patch Information

A security patch has been released to address this vulnerability. The fix is documented in the WordPress Restrict Content Changeset. Organizations should update to the latest version of the plugin through the WordPress admin dashboard or by downloading directly from the WordPress plugin repository.

For detailed vulnerability information, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Implement a web application firewall rule to validate and sanitize the rcp_redirect parameter, blocking requests with external URLs
• Temporarily disable the password reset functionality through the plugin settings until the update can be applied
• Configure your WordPress installation to only allow redirects to whitelisted internal URLs

# Example WAF rule to block external redirects (ModSecurity)
SecRule ARGS:rcp_redirect "^https?://(?!yourdomain\.com)" \
    "id:1001,phase:1,deny,status:403,msg:'Blocked external redirect attempt'"