The Kadence Memberships plugin for WordPress (formerly Restrict Content) contains a password reset link poisoning vulnerability affecting all versions up to and including 4.0.0. The legacy lost-password handler rc_process_lost_password_form() accepts an attacker-controlled rc_redirect POST parameter without validation, redirecting password reset emails to attacker-controlled hosts. The nonce required to trigger this handler is publicly exposed via the [login_form] shortcode, making it accessible to unauthenticated attackers. An attacker can issue a password reset for any account, including administrators, causing the reset key to be sent to an attacker-controlled URL. When the victim clicks the poisoned link, the reset key is leaked to the attacker, who can replay it against the legitimate site to complete a full account takeover. The vulnerability stems from two unvalidated sinks in legacy/includes/forms.php at lines 243 and 306. A patch was released in version 4.0.1.