CVE-2026-4136 describes an unvalidated redirect vulnerability in the Membership Plugin – Restrict Content for WordPress. The issue arises from insufficient validation of the 'rcp_redirect' parameter, which is used in password reset emails. Attackers can leverage this flaw to redirect users to arbitrary external URLs, potentially leading to phishing or other malicious sites. This vulnerability affects all versions up to and including 3.2.24 and is categorized under CWE-640, indicating weaknesses in the password recovery process. The CVSS 3.1 base score is 4.3, with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality or availability impact, and low integrity impact.

The vulnerability allows unauthenticated attackers to redirect users who receive password reset emails to potentially malicious websites. This could facilitate phishing attacks or other social engineering exploits targeting users of the plugin. There is no direct impact on confidentiality or availability, and the integrity impact is low. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisory for updates and apply any official fixes once released. Until then, caution should be exercised with password reset links, and users should verify URLs before clicking. No vendor advisory states that the issue is already mitigated or requires no action.