CVE-2026-9273: Membership Plugin – Kadence Memberships <= 4.0.0 Unauthenticated Password Reset Link Poisoning to Account Takeover PoC, Patch Analysis & Rule
Atomic Edge published a technical deep-dive on CVE-2026-9273, a critical password reset link poisoning vulnerability in the Kadence Memberships WordPress plugin (formerly Restrict Content) affecting versions up to 4.0.0. The writeup identifies the root cause as unsanitized use of the attacker-controlled rc_redirect POST parameter in legacy/includes/forms.php, passed directly to wp_redirect() at line 243 and add_query_arg() at line 306 without domain validation. The exploitation chain relies on a nonce publicly embedded in the [login_form] shortcode HTML, allowing any unauthenticated visitor to trigger a password reset for an arbitrary user with a poisoned redirect URL. When the victim clicks the resulting email link, the valid reset key is leaked to the attacker's server and replayed against the legitimate site for full account takeover including administrator accounts. The article includes an inline unified diff showing the 4.0.1 patch, which introduces wp_validate_redirect() to restrict destinations to the site's own domain and wp_safe_redirect() to block external redirects. A PHP PoC script is provided. The Wordfence threat-intel database independently confirms the vulnerability details and credits researcher scort (bjCSIRT/ASIN). The WordPress.org plugin changelog for 4.0.1 confirms 'Security: Strengthened security measures for password recovery.' The source does not establish that the PoC is verified, reliable, or safe in real-world conditions.
Research notes
- Root causeThe unsanitized 'rc_redirect' POST parameter in legacy/includes/forms.php is passed directly to wp_redirect() and add_query_arg() without domain validation, allowing an attacker to inject an external URL into the password reset email.
- Technical detailThe nonce required for the password reset request is publicly embedded in the [login_form] shortcode HTML source, making it available to any anonymous visitor.
- Exploit chainAn unauthenticated attacker can poison the password reset link to point to an attacker-controlled domain; when the victim clicks the link, the valid reset key is leaked to the attacker, who can replay it to reset the victim's password and achieve account takeover including administrator accounts.
- MitigationThe patch in version 4.0.1 uses wp_validate_redirect() to restrict redirect destinations to the site's own domain and wp_safe_redirect() to block external redirects.