The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to an unvalidated redirect in the password reset process. The plugin fails to properly validate the rcp_redirect parameter, allowing an unauthenticated attacker to embed a malicious URL in the password reset email. If the user follows the link, they are redirected to the attacker’s site, enabling credential harvesting or other social‑engineering attacks. The weakness is classified as CWE‑640.

All installations of the Restrict Content membership plugin version 3.2.24 and earlier, maintained by StellarWP, are affected. The CNAs list the product as StellarWP:Membership Plugin – Restrict Content, with every prior release vulnerable to this flaw.

The CVSS score is 4.3, indicating moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a phishing scenario where an attacker sends a password‑reset email containing a malicious redirect link. Since the redirect is not constrained, exploitation requires only convincing the user to click the link, making the risk moderate to high for sites that use the password‑reset feature.