EUVD-2026-53042
GHSA-j7vx-fw83-2v34
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Unauthenticated network attack (PR:N, AV:N, AC:L) but victim must click the poisoned link (UI:R); key leak and account takeover give C:H/I:H, A:N, and impact stays in the auth system so S:U.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Membership Plugin - Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rc_process_lost_password_form() consuming the attacker-controlled rc_redirect POST parameter into two unvalidated sinks in legacy/includes/forms.php: wp_redirect( esc_url( $_POST['rc_redirect'] ) . ... ) at line 243, and add_query_arg( array( 'key' => $key, 'login' => ... ), $_POST['rc_redirect'] ) inside rc_send_password_reset_email() at line 306. The nonce required to reach the handler is broadcast by the public [login_form] shortcode at line 207 to any anonymous visitor. This makes it possible for unauthenticated attackers to issue a password-reset request for any account (including administrators) whose reset email body points the victim at an attacker-controlled host carrying a valid reset key/login. When the victim clicks the link, the reset key leaks to the attacker, who can replay it against the legitimate site to complete account takeover.
AnalysisAI
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the site expose the plugin's legacy lost-password flow - specifically a page rendering the [login_form] shortcode, which publicly broadcasts the nonce (line 207) needed to reach rc_process_lost_password_form(); without that shortcode present, an anonymous attacker lacks a valid nonce. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N (9.3) indicates a network-reachable, low-complexity, unauthenticated attack whose only meaningful barrier is user interaction - the victim must click the poisoned reset link. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits the plugin's lost-password form for an administrator's username, supplying rc_redirect set to an attacker-controlled host; because the public [login_form] nonce is reused, the request is accepted and WordPress emails the admin a reset link built against the attacker's domain but carrying a valid key and login. The admin clicks the link, their browser hands the reset key to the attacker's server, and the attacker replays key+login against the legitimate site to set a new password and take over the account. … |
| Remediation | Vendor-released patch: 4.0.1 - update the Membership Plugin - Kadence Memberships plugin to 4.0.1 or later immediately, as confirmed by the WordPress plugin changeset comparing tags 4.0.0 and 4.0.1 (https://plugins.trac.wordpress.org/changeset?new=3549742%40restrict-content%2Ftags%2F4.0.1&old=3529319%40restrict-content%2Ftags%2F4.0.0) and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/ca38c423-2df8-4f20-bd95-2ecd84167a7f). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, disable the Kadence Memberships plugin to eliminate the attack vector, or implement Web Application Firewall rules to block the rc_redirect parameter in password-reset POST requests; simultaneously audit access logs for suspicious password-reset activity and force immediate password resets for all administrative accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today