PT-2026-26554 · WordPress · Restrict Content

Supakiad S · Publicado 2026-03-20 · Atualizado 2026-03-20 · CVE-2026-4136

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Membership Plugin – Restrict Content versions prior to 3.2.24

Description The Membership Plugin – Restrict Content plugin for WordPress is susceptible to an unvalidated redirect issue in all versions up to and including 3.2.24. This occurs because of inadequate validation of the redirect URL provided through the rcp redirect parameter. An unauthenticated attacker can potentially redirect users who have requested a password reset email to malicious websites if they can trick the user into performing an action.

Recommendations Versions prior to 3.2.24 should be updated to version 3.2.24 or later.

Correção

Enumeração de Fraquezas

CWE-640

Identificadores relacionados

CVE-2026-4136

Produtos afetados

Restrict Content

Referências · 6

• https://twitter.com/VulmonFeeds/status/2034854365417156614 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3486071/restrict-content · Nota
• https://twitter.com/CVEnew/status/2034891570474864711 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/e4cf42d3-9864-440b-8357-36c82cbef28f?source=cve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-4136 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.24/core/includes/login-functions.php#L270 · Nota