CVE-2026-9273 is a critical vulnerability in the Membership Plugin – Kadence Memberships WordPress plugin (formerly Restrict Content) affecting all versions up to and including 4.0.0. The issue arises from the legacy lost-password handler rc_process_lost_password_form() which accepts an attacker-controlled POST parameter rc_redirect without proper validation. This parameter is used in two unvalidated sinks: wp_redirect() and add_query_arg() in legacy/includes/forms.php. The nonce required to trigger this handler is publicly accessible via the [login_form] shortcode, allowing unauthenticated attackers to initiate password reset requests for any user account. The reset email sent to victims contains links pointing to attacker-controlled hosts with valid reset keys, enabling attackers to capture these keys when victims click the links and subsequently complete account takeover.

Successful exploitation allows unauthenticated attackers to perform account takeover of any user, including administrators, by poisoning password reset links. This compromises confidentiality and integrity of user accounts but does not affect availability. The vulnerability has a CVSS 3.1 score of 9.3 (critical), reflecting its high impact and ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the password reset functionality or disable the legacy lost-password handler if possible. Monitor vendor communications for updates and apply patches promptly once released.