CVE-2026-9273

Name of the Vulnerable Software and Affected Versions Kadence Memberships versions prior to 4.0.1

Description An issue exists where the legacy lost-password handler rc process lost password form() consumes the attacker-controlled rc redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php. This occurs via wp redirect() and add query arg() inside the rc send password reset email() function. Because the required nonce is broadcast by the public [login form] shortcode to anonymous visitors, unauthenticated attackers can trigger password-reset requests for any account, including administrators. By poisoning the reset email to point to an attacker-controlled host, the reset key is leaked when the victim clicks the link, allowing the attacker to replay it and take over the account.

Recommendations Update to a version newer than 4.0.0.