What is the CVSS score of EUVD-2026-13521?

EUVD-2026-13521 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-13521?

Organizations using for WordPress is vulnerable to Unvalidated Redirect in all should be aware of moderate risk from CVE-2026-4136 rated CVSS 4.3.

How to fix or mitigate EUVD-2026-13521?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Unvalidated Redirect in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress EUVD-2026-13521

| CVE-2026-4136 MEDIUM

Weak Password Recovery Mechanism for Forgotten Password (CWE-640)

2026-03-20 security@wordfence.com

WordPress Information Disclosure

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13521

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 04:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Membership Plugin - Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due to insufficient validation on the redirect url supplied via the 'rcp_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.

AnalysisAI

The Membership Plugin - Restrict Content for WordPress contains an unvalidated redirect vulnerability in the 'rcp_redirect' parameter that allows unauthenticated attackers to redirect users to arbitrary external sites via password reset emails. Affected versions include all releases up to and including 3.2.24. This vulnerability has a CVSS score of 4.3 (low-to-moderate severity) and requires user interaction, limiting its immediate exploitation impact but creating a viable phishing vector for credential harvesting or malware distribution.

Technical ContextAI

The vulnerability exists in the WordPress plugin architecture where user-supplied input from the 'rcp_redirect' parameter in the password reset email flow is not properly validated against a whitelist of acceptable redirect destinations. The root cause is classified under CWE-640 (Weak Password Recovery Mechanism in Authentication), though the direct issue is CWE-601 (URL Redirection to Untrusted Site). The affected product is the Membership Plugin – Restrict Content plugin for WordPress, a widely-deployed membership and content restriction solution. The vulnerability manifests in the login-functions.php file (line 270 as referenced in the WordPress plugin repository), where redirect URL handling lacks sufficient sanitization before passing the parameter to WordPress's wp_safe_remote_get() or similar redirect functions.

RemediationAI

Immediately upgrade the Membership Plugin – Restrict Content to version 3.2.25 or later, which includes proper validation of the 'rcp_redirect' parameter. Users unable to patch immediately should implement the following mitigations: (1) disable password reset functionality if not critical to operations, (2) implement WordPress security headers including Content-Security-Policy to restrict redirect targets, (3) deploy email authentication (DMARC, SPF, DKIM) to prevent spoofing of password reset emails, and (4) educate users to verify redirect destinations in password reset emails before clicking. Additional technical controls include using a Web Application Firewall (WAF) to detect and block requests with suspicious rcp_redirect parameters containing external domains. Refer to the Wordfence vulnerability intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/e4cf42d3-9864-440b-8357-36c82cbef28f) and the NVD advisory (https://nvd.nist.gov/vuln/detail/CVE-2026-4136) for ongoing monitoring.