Five WordPress Plugin Flaws, All Ending in Account Takeover (CVE-2026-9273)

Top/Articles/Five WordPress Plugin Flaws, All Ending in Account Takeover (CVE-2026-9273)

NewsPublished Aug. 5, 2026 Updated today

Table of contents

Key takeaways

Five WordPress plugin vulnerabilities were published on August 5, 2026, and all five end in account takeover. Kadence Memberships lets an unauthenticated attacker hijack an administrator's password reset; Dokan lets anyone who can register as a vendor seize an administrator account. All five already have fixed releases, so updating ends it.

Five WordPress plugin vulnerabilities were published on August 5, 2026. All five end in the same place: someone takes over an account. Hijacking a password reset, quietly creating an administrator, rewriting somebody else's password — different routes, one destination.

The good news first. All five already have fixed releases. Nothing here has been pulled from the directory; nothing is unfixable. Updating the plugin is enough to put you outside the affected range in every one of the five cases.

The problem is the sites that will not update. This batch includes Dokan, the standard plugin for building a multi-vendor marketplace — 4.43 million cumulative downloads — and its flaw means anyone who can register as a vendor can rewrite an administrator's password. If that sounds like your site, at least read the table.

All five at a glance

Plugin	ID	Severity	Affected	Update to	Login?
Kadence Memberships (formerly Restrict Content)	CVE-2026-9273	9.3	≤ 4.0.0	4.0.1	None
Smart Popup by Supsystic	CVE-2026-18322	8.8	≤ 1.12.0	1.13.0	None
Dokan	CVE-2026-8761	8.8	≤ 5.0.1	5.0.12	Vendor
VikAppointments	CVE-2026-15918	7.5	≤ 1.2.19	1.2.20	None
VikRentItems	CVE-2026-16143	7.2	≤ 1.2.1	1.2.2	None

* Severity is CVSS 3.1 out of 10. "Login?" is what an attacker needs; "None" means anyone can try it. The update targets are the newest releases available at the time of writing.

If none of these are installed, this batch does not concern you. WordPress plugin flaws are published nearly every week, though, and we have covered 27 of them on August 3 and another 27 on August 2, six with no fix at all. Worth noting: a round where every entry already has a patch is the unusual one.

What each one does

CVE-2026-9273: the password reset email points at the attacker's site

The most severe of the five. Kadence Memberships (formerly Restrict Content) gates posts behind membership and has been downloaded 670,000 times.

The flaw is in the forgotten-password flow. The value specifying where to send the user after a reset was taken from the request and used without validation. An attacker sets it to their own address and requests a reset for any account — administrators included.

The victim then receives a genuine reset email from the genuine site. But the link inside points at the attacker's host, carrying the reset key. The moment the victim clicks, that key is in the attacker's hands. Replaying it against the real site completes the takeover.

The one-time token that should have gated the handler was printed into any page carrying the public login form, visible to anonymous visitors. So no login is required. The same reset-hijack pattern was exploited in the wild against Kirki, affecting 500,000 sites — this is not an exotic technique.

CVE-2026-18322: an administrator account created through a popup's settings

Smart Popup by Supsystic displays notification popups and has 1.66 million cumulative downloads. It also offers newsletter signup forms.

The flaw is in permission handling. The list of administrator-only actions was overwritten internally by another list, silently dropping "save" from the protected set. On top of that, the token embedded in subscription confirmation emails is accepted by the endpoint. Subscribing and receiving the confirmation email hands an attacker everything they need.

With that token they rewrite the setting that decides what role new subscribers receive, changing it to "administrator." Walking through the subscription flow once more leaves a persistent administrator account with credentials of the attacker's choosing.

CVE-2026-8761: a vendor can rewrite the administrator's password

The most widely installed plugin in this batch. Dokan turns WordPress and WooCommerce into a multi-vendor marketplace and has 4.43 million cumulative downloads.

Dokan re-registers WooCommerce's customer management routes under its own namespace. In doing so it replaced WooCommerce's capability check with one that only asks whether the caller is a vendor. It never checks who the target is.

So anyone with vendor-level access or above can read, modify or delete any user on the site, administrators included. Set the password field on an administrator's record and the site belongs to them.

You might think vendor access is a meaningful barrier. Marketplaces normally leave vendor registration open, because attracting vendors is the point. Where applications are auto-approved, "vendor-level access" means "anyone." That is what separates this 8.8 from the others.

CVE-2026-15918: user credentials pulled out through a booking page

VikAppointments handles appointment booking for salons, clinics and similar businesses. At around 22,000 cumulative downloads it is smaller than the three above, but the data it handles is not.

A parameter controlling how the public reviews list is sorted went into a database query without validation — a SQL injection, letting an attacker rewrite the query itself. No login needed. From an ordinary booking page, WordPress user records, including stored password hashes, can be read out.

CVE-2026-16143: script planted in a booking form's email field

VikRentItems manages rental inventory and has roughly 17,000 cumulative downloads. It comes from the same developer as the previous entry.

The email field on the booking form is not sanitized adequately. The stored value passes through text sanitization only, so characters that break out of an HTML attribute — quotation marks — survive, and the order-editing screen in the admin area prints the stored value without escaping it.

In other words, an anonymous visitor places a booking, and the planted script runs later in the browser of whichever administrator opens that order. Running with administrator privileges, it can go on to add users or change settings.

Who goes after this, and why

Flaws like these are not used by anyone targeting your company specifically. They are used by operations that wait for disclosures and then sweep the internet for sites running the plugin. Within days of publication, the same request is thrown at sites worldwide. You get hit not because your site matters, but because it is one of the ones that has not updated.

And what they do once in? Add one administrator account and leave without touching anything else. That is the most common move. Vandalism gets noticed; a legitimate-looking account means they can come back whenever they like. The eventual uses are spam pages that poison search results, a relay for attacks on other sites, or a skimmer injected into the checkout page.

What you lose depends on the site. A membership site exposes member names and addresses; a booking site exposes appointment times and contact details; a marketplace exposes both vendors and buyers. And the heaviest cost to an operator is losing the ability to say when it happened. One missed update creates a period afterwards that you can never certify as clean.

Are you affected, and how do you check?

Open Plugins in the WordPress admin and you get every installed extension with its version. Compare against the table. If a name matches and the version is at or below the "Affected" column, it applies to you.

The easy miss is plugins deactivated but not deleted. Most flaws will not fire while a plugin is inactive, but the files remain and can be chained with other issues. Delete what you do not use rather than deactivating it.

One more: if you run Dokan, check how vendor registration is configured. If applications are auto-approved, the privilege this attack needs is available to anyone. That is materially more dangerous than a site where an administrator approves each vendor by hand.

What to do

One thing. Update the affected plugins. It takes minutes from the Updates screen. All five have shipped fixes; there is nothing to wait for.

After updating, a few places are worth a look.

Worth checking after you update

▸Administrator accounts in the users list that you did not create (two of these flaws create or seize administrators)
▸Whether the administrator email address has been changed — a common preparatory step in a takeover
▸If you run Dokan, any suspicious entries in the vendor list
▸Bookings or orders whose contents look obviously wrong (the VikRentItems issue is planted through the booking form)

If anything looks off, change the administrator password and force everyone to log out first. That cuts off any session an intruder was holding. If the password is reused elsewhere, change it there too.

As a standing measure, turning on automatic plugin updates does the most good. It can be set per plugin from the admin screen, and in a round like this one — where fixes exist at disclosure — it closes the matter by itself. If you prefer to review updates before applying them, at minimum open the admin screen once a week. The attackers move within days of publication.

Is anyone exploiting these?

As of this writing there are no reports of exploitation, and none of the five appears in the U.S. CISA catalog of vulnerabilities known to be exploited (KEV).

That said, attacks on WordPress plugins are known for an extremely short gap between disclosure and first attempts. Among cases we have covered, Kirki's password-reset flaw and the LiteSpeed cPanel plugin were both confirmed exploited shortly after publication. "Not attacked yet" does not mean "safe going forward."

All five were assigned by Wordfence, which specializes in WordPress security. We found no corresponding entry from Japan's JVN or JPCERT/CC as of August 5.

Summary

The five WordPress plugin vulnerabilities published on August 5, 2026 all lead to account takeover. The most severe is Kadence Memberships (CVE-2026-9273, severity 9.3), where an unauthenticated attacker hijacks an administrator's password reset. The most widely deployed is Dokan (CVE-2026-8761), where anyone able to register as a vendor can take over an administrator.

All five have fixes. Kadence Memberships 4.0.1, Smart Popup 1.13.0, Dokan 5.0.12, VikAppointments 1.2.20, VikRentItems 1.2.2. Updating from the admin screen ends it.

Lined up together, the five share one trait: the permission check looks at who is asking and never at who is being acted upon. Dokan is the clearest case — it verified the caller was a vendor, but never that the target was not an administrator. The same shape of oversight ran through the three plugins we covered on July 16. When choosing an extension, how quickly its past flaws were fixed is worth as much attention as whether it is still maintained.

Sources

Makoto Horikawa

Backend Engineer / AWS / Django