Account takeover vulnerability affecting the Kadence Memberships plugin for WordPress

Membership Plugin - Kadence Memberships (formerly Restrict Content) is a membership management plugin published by StellarWP for WordPress, used on many websites for managing accounts and content reserved for members. This plugin is affected by a vulnerability labeled CVE-2026-9273, resulting from the use of the POST parameter rc_redirect by the old forgotten password management mechanism rc_process_lost_password_form(), which transmits it without validation to two points of use. A publicly exposed security token would also make it possible to trigger a reset request targeting any account without prior authentication. Exploitation of this vulnerability would allow an unauthenticated attacker to cause a reset email to be sent to a targeted account by inserting a destination they control. The takeover would occur when the legitimate user activates the received link, with the reset token then passed to the malicious actor. It is classified critical with a severity score of 9.3 according to CVSS V3.1.

• Versions of Membership Plugin - Kadence Memberships prior to or equal to version 4.0.0;