CVE-2026-9273 is a critical vulnerability (CVSS 9.3) in the Membership Plugin – Kadence Memberships WordPress plugin (versions up to and including 4.0.0). The legacy lost-password handler rc_process_lost_password_form() accepts an attacker-controlled POST parameter rc_redirect without proper validation. This parameter is used in two unvalidated sinks: wp_redirect() and add_query_arg() within the password reset email function. The nonce required to trigger this handler is publicly exposed via the [login_form] shortcode, allowing unauthenticated attackers to initiate password reset requests for any user account. The crafted reset email directs victims to attacker-controlled URLs containing valid reset keys, which leak to the attacker upon victim interaction. The attacker can then replay these keys to complete account takeover.

Successful exploitation allows unauthenticated attackers to take over any user account, including administrators, by poisoning password reset links. This leads to full account compromise without requiring prior authentication, resulting in complete loss of confidentiality and integrity of affected accounts. There is no indication of availability impact. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the legacy lost-password handler or the [login_form] shortcode if possible, and monitor for updates from the vendor. Avoid clicking password reset links from untrusted sources. Follow the vendor's guidance once published.