Kadence Memberships CVE-2026-9273

Exploitation requires that the site expose the plugin's legacy lost-password flow - specifically a page rendering the [login_form] shortcode, which publicly broadcasts the nonce (line 207) needed to reach rc_process_lost_password_form(); without that shortcode present, an anonymous attacker lacks a valid nonce. The attacker sets the rc_redirect POST parameter to a host they control, and must know or guess the target's username/account. The decisive limiting factor is user interaction (UI:R): the poisoned reset link is delivered to the victim's real inbox, so the victim (e.g., an administrator) must actually click the attacker-hosted link before the key leaks - the attack fails if the target ignores or inspects the email. Affects default installs running the legacy handler in all versions up to and including 4.0.0; no authentication is required of the attacker (PR:N).

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3) indicates a network-reachable, low-complexity, unauthenticated attack whose only meaningful barrier is user interaction - the victim must click the poisoned reset link. That single dependency is realistic against high-value targets (an admin receiving a 'password reset' email is plausibly primed to click), so UI:R lowers but does not eliminate practical risk. No EPSS score was provided and the CVE is not in CISA KEV, so there is no evidence of active exploitation; likewise no POC is referenced, so this is currently a theoretical-but-well-understood primitive rather than a confirmed campaign. The nonce being publicly broadcast (line 207) removes the usual anti-CSRF gate, meaning attack complexity genuinely is low. Net: a real priority to patch because it yields full administrator account takeover with no authentication, but the UI:R requirement and absence of KEV/POC/EPSS signals suggest opportunistic or targeted phishing-style abuse rather than mass automated exploitation. Note the S:C (scope change) rating is debatable - the impact stays within the WordPress authentication system, so some analysts would rate S:U.

An attacker submits the plugin's lost-password form for an administrator's username, supplying rc_redirect set to an attacker-controlled host; because the public [login_form] nonce is reused, the request is accepted and WordPress emails the admin a reset link built against the attacker's domain but carrying a valid key and login. The admin clicks the link, their browser hands the reset key to the attacker's server, and the attacker replays key+login against the legitimate site to set a new password and take over the account. No public POC is referenced, but the technique is well documented and low-complexity given the low attack complexity in the CVSS vector.