Password reset link poisoning in Kadence Memberships WordPress plugin (CVE-2026-9273)

The Membership Plugin - Kadence Memberships for WordPress contains a password reset link poisoning vulnerability in its legacy lost-password handler, which consumes an attacker-controlled POST parameter into two unvalidated redirect sinks without sanitization. Because the nonce required to invoke the handler is publicly exposed via the [login_form] shortcode, unauthenticated attackers can trigger a password reset for any account-including administrators-redirecting the reset email to an attacker-controlled host and thereby capturing the reset key needed to complete a full account takeover. Affected versions: - <= 4.0.0 We recommend updating to: 4.0.1. CVSS 9.3 · our assessment: act_now Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/ca38c423-2df8-4f20-bd95-2ecd84167a7f?source=cve Details: https://vuln.today/cve/CVE-2026-9273