CVE-2026-4136

The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.2.24. This is due to insufficient validation on the redirect url supplied via the 'rcp_redirect' parameter. This makes it possible for unauthenticated attackers to redirect users with the password reset email to potentially malicious sites if they can successfully trick them into performing an action.

• CWE-640

• https://plugins.trac.wordpress.org/browser/restrict-content/tags/3.2.24/core/includes/login-functions.php#L270
• https://plugins.trac.wordpress.org/changeset/3486071/restrict-content
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e4cf42d3-9864-440b-8357-36c82cbef28f?source=cve

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41354OpenClaw before 2026.4.2 contains an insufficient scope vuln…5.3
• CVE-2026-41355OpenClaw before 2026.3.28 contains an arbitrary code executi…7.3
• CVE-2026-41356OpenClaw before 2026.3.31 fails to terminate active WebSocke…5.4
• CVE-2026-41357OpenClaw before 2026.3.31 contains an environment variable l…3.3
• CVE-2026-41358OpenClaw before 2026.4.2 fails to filter Slack thread contex…5.4
• CVE-2026-41359OpenClaw before 2026.3.28 contains a privilege escalation vu…8.8
• CVE-2026-41360OpenClaw before 2026.4.2 contains an approval integrity vuln…6.7
• CVE-2026-41361OpenClaw before 2026.3.28 contains an SSRF guard bypass vuln…7.1
• CVE-2026-41362OpenClaw versions 2026.2.19 before 2026.3.31 contain an impr…4.3
• CVE-2026-41363OpenClaw versions 2026.2.6 through 2026.3.24 contain a path …6.5
• CVE-2026-41364OpenClaw before 2026.3.31 contains a symlink following vulne…8.1
• CVE-2026-41365OpenClaw before 2026.3.31 contains a sender allowlist bypass…5.4