CVE-2026-9273: Critical Password Reset Link Poisoning Vulnerability in Kadence Memberships Plugin

Executive Intelligence Brief

A critical vulnerability (CVE-2026-9273) with a CVSS score of 9.3 has been discovered in the Kadence Memberships plugin for WordPress. This vulnerability allows unauthenticated attackers to poison password reset links, potentially leading to account takeovers. The affected versions include all versions up to and including 4.0.0. Immediate patching is strongly recommended to prevent potential account takeovers, especially for administrator accounts.

Threat Overview

The Kadence Memberships plugin, formerly known as Restrict Content, is a popular WordPress plugin used for membership management. The vulnerability is due to the legacy lost-password handler consuming an attacker-controlled POST parameter, leading to unvalidated sinks in the plugin's code. This makes it possible for attackers to issue password-reset requests for any account, including administrators, and gain control of the account when the victim clicks the malicious link.

Technical Deep Dive

Vulnerability Classification

The vulnerability is classified as CWE-640, which involves weaknesses in password recovery mechanisms. Specifically, this vulnerability allows for password reset link poisoning, enabling attackers to manipulate the password reset process and potentially take over accounts.

Root Cause Analysis

The root cause of this vulnerability lies in the legacy lost-password handler, specifically in the `rc_process_lost_password_form()` function. This function consumes the attacker-controlled `rc_redirect` POST parameter into two unvalidated sinks in `legacy/includes/forms.php`. The nonce required to reach the handler is broadcast by the public `[login_form]` shortcode to any anonymous visitor, making it exploitable by unauthenticated attackers.

Attack Vector & Chain

The attack vector involves an unauthenticated attacker sending a crafted request to the password reset handler. The attacker can manipulate the `rc_redirect` parameter to control the redirect URL in the password reset email. When the victim (whose account the attacker has targeted) clicks the password reset link, the attacker can capture the reset key and use it to complete the account takeover.

Exploitation Scenario Walkthrough

Scenario: Account Takeover via Password Reset Link Poisoning
Reconnaissance: An attacker discovers a WordPress site using the vulnerable Kadence Memberships plugin (version 4.0.0 or earlier).
Weaponization: The attacker prepares a malicious request with a crafted `rc_redirect` parameter pointing to an attacker-controlled host.
Delivery & Exploitation: The attacker sends a password reset request to the vulnerable site, manipulating the `rc_redirect` parameter to point to their controlled host. The site sends a password reset email to the targeted victim's email address, containing a link with the attacker-controlled host and a valid reset key.
Post-Exploitation: When the victim clicks the link, the attacker captures the reset key. The attacker then replays this key against the legitimate site to complete the account takeover.
Impact Realization: The attacker gains full control of the victim's account, potentially leading to unauthorized access, data breaches, or further malicious activities.

Exploitation in the Wild

There is no indication that this vulnerability is currently being actively exploited in the wild. However, given its critical severity and potential impact, it is essential to patch immediately to prevent future exploitation.

Impact Analysis

Direct Impact

The direct impact of this vulnerability is the potential for account takeovers, especially for administrator accounts. This could lead to unauthorized access to sensitive information, modification of site settings, or further exploitation of the compromised site.

Downstream & Cascading Effects

The downstream effects could include supply chain compromises if the compromised site is used to distribute malicious content or act as a pivot point for further attacks. Additionally, there could be regulatory implications and customer data exposure if sensitive information is accessed or leaked.

Affected Products & Versions

The Kadence Memberships plugin versions up to and including 4.0.0 are affected. Users should update to a patched version (4.0.1 or later) immediately.

Detection & Threat Hunting

Indicators of Compromise

Indicators of compromise may include unusual password reset requests, suspicious account activity, or unauthorized changes to site settings or content.

Detection Rules & Signatures

Detection logic could involve monitoring for anomalous patterns in password reset requests, especially those involving suspicious redirects or URLs. Relevant MITRE ATT&CK techniques include T1078 (Valid Accounts) and T1204 (User Data).

Threat Hunting Queries

Threat hunting queries could involve searching for:

• Unusual patterns in password reset requests
• Suspicious URLs or redirects in request logs
• Anomalous account activity, especially related to administrator accounts

Remediation & Hardening

Immediate Actions (0-24 hours)

1. Update the Kadence Memberships plugin to version 4.0.1 or later.
2. Monitor for suspicious password reset requests and account activities.
3. Implement additional security measures such as Web Application Firewalls (WAFs) to detect and block suspicious traffic.

Short-Term Hardening (1-7 days)

1. Enhance monitoring of login and account activities.
2. Implement multi-factor authentication for administrator accounts.
3. Conduct a thorough review of site logs and user accounts for signs of compromise.

Strategic Recommendations

1. Regularly update all plugins and themes to the latest versions.
2. Implement a robust security monitoring system to detect and respond to threats in real-time.
3. Conduct regular security audits and penetration testing to identify and address vulnerabilities proactively.

Analyst Assessment

The risk of exploitation is currently low since there are no reports of active exploitation. However, given the critical severity of this vulnerability and its potential impact, immediate patching and enhanced monitoring are essential to prevent future exploitation and potential account takeovers.

Sources

• National Vulnerability Database (NVD) - CVE-2026-9273
• Wordfence Threat Intelligence