An issue exists where the legacy lost-password handler `rc process lost password form()` consumes the attacker-controlled `rc redirect` POST parameter into two unvalidated sinks in legacy/includes/forms.php. This occurs via `wp redirect()` and `add query arg()` inside the `rc send password reset email()` function. Because the required nonce is broadcast by the public `[login form]` shortcode to anonymous visitors, unauthenticated attackers can trigger password-reset requests for any account, including administrators. By poisoning the reset email to point to an attacker-controlled host, the reset key is leaked when the victim clicks the link, allowing the attacker to replay it and take over the account.