What is CVE-2026-9273?

CVE-2026-9273 is a critical-severity vulnerability in Stellarwp Membership Plugin – Kadence Memberships, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 9.3/10. Published 2026-08-05.

How severe is CVE-2026-9273?

Critical severity. CVSS v3 base score is 9.3 out of 10.

Vulnerability in Stellarwp Membership Plugin – Kadence Memberships

CVE-2026-9273

The Membership Plugin – Kadence Memberships plugin for WordPress (formerly Restrict Content) is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy…

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.

Affected products

Stellarwp Membership Plugin – Kadence Memberships — versions 0

Weakness classification (CWE)

CWE-640 — Weak Password Recovery Mechanism for Forgotten Password

References

security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com
security@wordfence.com

Frequently asked questions

What is CVE-2026-9273?: CVE-2026-9273 is a critical-severity vulnerability in Stellarwp Membership Plugin – Kadence Memberships, classified under Weak Password Recovery Mechanism for Forgotten Password. CVSS score: 9.3/10. Published 2026-08-05.
How severe is CVE-2026-9273?: Critical severity. CVSS v3 base score is 9.3 out of 10.