Membership Plugin Restrict Content Unvalidated Redirect Vulnerability in Password Reset Flow

A vulnerability allowing unvalidated redirects has been identified in the Membership Plugin – Restrict Content for WordPress, affecting all versions through 3.2.24. The issue arises from inadequate validation of the redirect URL provided via the 'rcp_redirect' parameter. This flaw enables unauthenticated attackers to redirect users receiving password reset emails to potentially harmful sites, provided they can successfully manipulate the users into taking a specific action.

Impact

Exploitation of this vulnerability could lead to users being redirected to malicious websites, potentially causing harm or allowing for further attacks.

Remediation

Users can update to version 3.2.25 or a newer patched version to address this vulnerability.