CVE-2026-9273 Overview
CVE-2026-9273 is a password reset link poisoning vulnerability in the Membership Plugin – Kadence Memberships for WordPress (formerly Restrict Content). All versions up to and including 4.0.0 are affected. The legacy lost-password handler rc_process_lost_password_form() consumes the attacker-controlled rc_redirect POST parameter and passes it into two unvalidated sinks in legacy/includes/forms.php. Unauthenticated attackers can trigger a password reset for any account, including administrators, and redirect the reset link to an attacker-controlled host. When the victim clicks the link, the reset key leaks to the attacker, enabling account takeover [CWE-640].
Critical Impact
Unauthenticated attackers can hijack administrator accounts on WordPress sites running vulnerable Kadence Memberships installations by intercepting password reset keys.
Affected Products
- Kadence Memberships (formerly Restrict Content) WordPress plugin, versions ≤ 4.0.0
- Fixed in version 4.0.1
- WordPress sites exposing the [login_form] shortcode
Discovery Timeline
- 2026-08-05 - CVE-2026-9273 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-9273
Vulnerability Analysis
The vulnerability resides in the legacy lost-password workflow shipped by the plugin under legacy/includes/forms.php. The public [login_form] shortcode broadcasts the nonce required to reach rc_process_lost_password_form() at line 207, making the handler reachable by any anonymous visitor. The handler then reads the rc_redirect value from the POST body without validating that it points to the same origin or to a WordPress-controlled URL.
Two sinks consume this attacker-controlled value. At line 243, the handler invokes wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ). At line 306, inside rc_send_password_reset_email(), the code calls add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ). The esc_url() filter enforces character encoding but does not restrict the host, so external URLs pass through unchanged.
Root Cause
The root cause is missing host validation on a user-supplied redirect target that is used to construct the password reset URL embedded in the outgoing email body. The plugin trusts client input for a security-sensitive URL rather than deriving the reset link from home_url() or network_site_url(). This is a textbook instance of [CWE-640] – Weak Password Recovery Mechanism for Forgotten Password.
Attack Vector
An unauthenticated attacker submits the lost-password form on any page rendering the [login_form] shortcode, supplying the target account's username or email in the standard field and setting rc_redirect to an attacker-controlled host. WordPress generates a valid reset key for the account and builds the reset URL by concatenating the attacker's host with the key and login query parameters. The victim receives the email and clicks the poisoned link, delivering the reset key to the attacker's server via HTTP referer, access log, or intentional endpoint. The attacker replays the key and login values against the legitimate WordPress site to complete the password reset and take over the account.
Detection Methods for CVE-2026-9273
Indicators of Compromise
- POST requests to WordPress pages containing the [login_form] shortcode with an rc_redirect parameter pointing to an external host.
- Outbound password reset emails whose reset URLs do not match the site's canonical hostname.
- Successful password changes for administrator accounts shortly after a lost-password submission originating from an unfamiliar IP.
Detection Strategies
- Inspect web server access logs for POST requests carrying rc_redirect= values with schemes or hosts outside the site's own domain.
- Correlate retrieve_password WordPress hook events with subsequent password_reset events for privileged users.
- Compare the Host header and referrer chain on requests hitting wp-login.php?action=rp against expected patterns.
Monitoring Recommendations
- Alert on lost-password submissions targeting administrator or editor usernames.
- Monitor for anomalous DNS lookups from mail clients following WordPress-originated reset emails.
- Track plugin version inventory across WordPress fleets and flag any host still running Restrict Content or Kadence Memberships ≤ 4.0.0.
How to Mitigate CVE-2026-9273
Immediate Actions Required
- Update the Kadence Memberships plugin to version 4.0.1 or later on all WordPress installations.
- Force a password reset for administrator and privileged accounts on any site that ran a vulnerable version.
- Audit recent password reset events and user role changes for signs of takeover.
- Rotate WordPress secret keys in wp-config.php if compromise is suspected, invalidating outstanding sessions and reset keys.
Patch Information
The vendor addressed the issue in Restrict Content / Kadence Memberships version 4.0.1. Review the fix in the WordPress ChangeSet Details and the third-party analysis in the Wordfence Vulnerability Report. The vulnerable code paths are documented in the WordPress Plugin Trac at forms.php line 207, line 243, and line 306.
Workarounds
- Remove the [login_form] shortcode from public pages until patching is complete to eliminate the anonymous nonce broadcast.
- Deploy a web application firewall rule that blocks POST requests to lost-password endpoints when rc_redirect contains a scheme or host outside the site's own domain.
- Restrict access to /wp-login.php and pages hosting the plugin's login form to authenticated IP ranges where feasible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
