WordPress Kadence Memberships Plugin Password Reset Poisoning

The Kadence Memberships plugin for WordPress contains a critical password reset link poisoning vulnerability (CVE-2026-9273, CVSS 9.3) affecting all versions through 4.0.0. The legacy lost-password handler fails to validate the rc_redirect POST parameter before passing it to wp_redirect() and add_query_arg() functions, allowing attackers to craft malicious password reset links that redirect users to attacker-controlled domains. This enables credential harvesting and complete account takeover, as victims receive legitimate-looking password reset notifications but are directed to phishing sites when clicking the reset link. Any WordPress site running this plugin with active user memberships is at immediate risk, regardless of site size or industry.

While this CVE lacks mapped MITRE ATT&CK techniques, Casky's AI-driven security skills would detect the attack patterns associated with this vulnerability by analyzing several behavioral indicators: suspicious POST parameter manipulation attempts (Input Manipulation), HTTP redirect chains to external domains (Command and Control), and authentication bypass patterns stemming from credential capture (Valid Accounts abuse). A practitioner using Casky would observe findings related to unvalidated user-controlled input flowing into sensitive functions, suspicious redirect destinations in web server logs, and authentication anomalies such as password reset requests from unexpected geographic locations or rapid account access changes following reset events. The extended reasoning capability would correlate these signals to identify the password reset link poisoning pattern and recommend immediate plugin updates, input validation audits, and user notification procedures.