CVE-2026-4136: 
WordPress vulnerability analysis and mitigation

CVE-2026-4136 is an open redirect (unvalidated redirect) vulnerability in the Membership Plugin – Restrict Content plugin for WordPress, developed by StellarWP. All versions up to and including 3.2.24 are affected. The flaw allows unauthenticated attackers to redirect users to arbitrary external URLs by manipulating the rcp_redirect parameter in password reset emails. It was published on March 20, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Red Hat CVE, ENISA EUVD).

The root cause is insufficient validation of the redirect URL supplied via the rcp_redirect parameter during the password reset flow, classified as CWE-640 (Weak Password Recovery Mechanism for Forgotten Password) and estimated as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). An unauthenticated attacker can craft a malicious password reset link embedding an arbitrary external URL in the rcp_redirect parameter; when a victim clicks the link in their reset email, they are silently redirected to the attacker-controlled site. The vulnerable code path is visible in the plugin source at core/includes/login-functions.php around line 270 (Wordfence, WordPress Trac).

Successful exploitation enables phishing attacks by redirecting users who click password reset links to attacker-controlled sites, where credentials or other sensitive information may be harvested. The integrity impact is low and confidentiality/availability are unaffected in isolation, but the social engineering potential — particularly credential theft via convincing phishing pages — elevates the practical risk. No direct server-side code execution or privilege escalation is possible through this vulnerability alone (ENISA EUVD, Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-4136. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — a victim must click the crafted password reset link — which limits opportunistic mass exploitation (Red Hat CVE, ENISA EUVD).

1. Reconnaissance: Identify WordPress sites running the Restrict Content plugin (version ≤ 3.2.24) via HTTP response headers, plugin enumeration tools (e.g., WPScan), or public search engines.
2. Craft malicious reset URL: Construct a password reset request URL for a known or guessed user account, appending a malicious external URL to the rcp_redirect parameter (e.g., https://target-site.com/wp-login.php?action=rp&rcp_redirect=https://attacker.com/phish).
3. Trigger password reset email: Submit the password reset form for the target user, causing the site to send a reset email containing the crafted link with the embedded redirect.
4. Social engineering: Wait for or trick the victim into clicking the password reset link in their email.
5. Harvest credentials: Upon clicking, the victim is redirected to the attacker's phishing page (e.g., a fake WordPress login page), where their credentials can be captured (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing password reset requests (action=rp or similar) with rcp_redirect parameters pointing to external or suspicious domains.
• Network: Outbound redirects (HTTP 3xx responses) from the WordPress site to non-site domains following password reset link clicks.
• User Reports: Users reporting unexpected redirects to unfamiliar sites after clicking password reset emails from the WordPress installation.

Update the Restrict Content plugin to version 3.2.25 or later, which includes a fix for the unvalidated redirect (the patch is available via the WordPress plugin repository changeset 3486071). As a temporary workaround, administrators can disable the password reset functionality or implement a web application firewall (WAF) rule to block requests where rcp_redirect contains external URLs. Monitoring password reset logs for anomalous redirect targets is also advisable (WordPress Trac Changeset, Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the advisory and assigned the CVE. Coverage has been limited to automated vulnerability aggregators and standard CVE feeds, with no notable researcher commentary or significant media coverage beyond routine disclosure (Wordfence).