CVE-2026-9273 stellarwp CVE debrief

Who should care

Administrators and users of the Membership Plugin – Kadence Memberships plugin for WordPress should be aware of this critical vulnerability and take immediate action to assess and mitigate the risk. This vulnerability can lead to account takeover, potentially allowing attackers to gain unauthorized access to sensitive information and perform malicious actions.

Technical summary

The Membership Plugin – Kadence Memberships plugin for WordPress is vulnerable to password reset link poisoning, potentially leading to account takeover. The issue exists in the legacy lost-password handler rc_process_lost_password_form(), which consumes the attacker-controlled rc_redirect POST parameter into two unvalidated sinks. A nonce required to reach the handler is broadcast by the public [login_form] shortcode to any anonymous visitor, allowing unauthenticated attackers to issue a password-reset request for any account.

Defensive priority

CVE-2026-9273 is a critical vulnerability in the Membership Plugin – Kadence Memberships plugin for WordPress, allowing for password reset link poisoning and potential account takeover. Immediate attention is required to assess and mitigate this vulnerability.

Recommended defensive actions

• Review and update the Membership Plugin – Kadence Memberships to the latest version
• Restrict access to the login and password reset functionality
• Monitor for suspicious password reset requests and account activities
• Implement additional security measures, such as IP blocking and rate limiting
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability exists in the Membership Plugin – Kadence Memberships plugin for WordPress, specifically in the legacy lost-password handler rc_process_lost_password_form(). The plugin is vulnerable to password reset link poisoning, potentially leading to account takeover. The issue arises from the consumption of the attacker-controlled rc_redirect POST parameter into two unvalidated sinks. A nonce required to reach the handler is broadcast by the public [login_form] shortcode to any anonymous visitor, allowing unauthenticated attackers to issue a password-reset request for any account. The CVE record and NVD entry provide details on the vulnerability, but further information about affected versions and patched releases is needed.

Official resources