Membership Plugin Kadence Memberships
Monthly
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3).
Account takeover in the Membership Plugin - Kadence Memberships (formerly Restrict Content) for WordPress affects all versions through 4.0.0 via password-reset link poisoning. The legacy lost-password handler trusts an attacker-controlled rc_redirect POST value, so an unauthenticated attacker can trigger a reset email for any account (including administrators) whose reset link points at an attacker-controlled host carrying a valid key/login; when the victim clicks it, the reset key leaks and can be replayed to seize the account. No public exploit identified at time of analysis, and the flaw is not in CISA KEV, but Wordfence-confirmed root cause and a straightforward primitive make this a high-priority patch (CVSS 9.3).