Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-9273— Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover

Quick assessment

Affected
stellarwp Membership Plugin – Kadence Memberships
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress Kadence Memberships是WordPress基金会开源的一款管理会员资格的CMS插件。 WordPress Kadence Memberships 4.0.0及之前版本存在授权问题漏洞，该漏洞源于密码重置链接投毒，攻击者利用未经验证的rc_redirect参数（位于legacy/includes/forms.php）构造恶意链接，可能导致账户接管。

CVSS 9.3 · Critical EPSS 0.51% · P41

Affected Version Matrix 1

VendorProduct Version RangeStatus
stellarwp Membership Plugin – Kadence Memberships ≤ 4.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-9273

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover
Source: CVE Program / CVE List V5
Vulnerability Description
The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
忘记口令恢复机制弱
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Kadence Memberships 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Kadence Memberships是WordPress基金会开源的一款管理会员资格的CMS插件。 WordPress Kadence Memberships 4.0.0及之前版本存在授权问题漏洞，该漏洞源于密码重置链接投毒，攻击者利用未经验证的rc_redirect参数（位于legacy/includes/forms.php）构造恶意链接，可能导致账户接管。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
stellarwp Membership Plugin – Kadence Memberships 0 ~ 4.0.0 -

II. Public POCs for CVE-2026-9273

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-9273

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-9273 (4)

News Coverage for CVE-2026-9273 (2)

IV. Related Vulnerabilities

Same vendor: stellarwp
Same weakness: CWE-640

V. Comments for CVE-2026-9273

No comments yet

Leave a comment