CVE-2026-19804
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress (versions up to and including 260814) is vulnerable to remote code execution via the 'first_name' parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. An unauthenticated attacker can execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.
Risk Assessment
An attacker can execute arbitrary code on the server, leading to full server compromise and data breach. The risk is critical because the attack does not require authentication and the conditions are often met.
Recommendation
Update the plugin to a version newer than 260814 if available. Otherwise, immediately disable the plugin or remove the %%first_name%% placeholder from Signup Tracking Codes templates and secure the proxy verification key.
Related vulnerabilities
- CVE-2026-117691Critical
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.
- CVE-2026-96677Critical
Cross-site Scripting (XSS) vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in page chrome fields (header, nav, footer, etc.), so applications that place request-derived values there reflect them unencoded.
- CVE-2026-73117Critical
HTTP Response Splitting (CRLF injection in HTTP headers) vulnerability in Apache Juneau. The REST server passed response header values and redirect targets to the servlet container unchecked, so request-derived data could allow header injection or redirect to an arbitrary site.
- CVE-2026-73116Critical
Insufficiently Protected Credentials vulnerability in Apache Juneau. The RestClient followed HTTP redirects while keeping credential headers from the original request, so a server redirecting to a different host, port, or from HTTPS to HTTP could receive Authorization, Cookie, Proxy-Authorization and X-API-Key headers.
- CVE-2026-73101Critical
Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response and may include internal exception messages in the error body, even with stack-trace rendering disabled.
- CVE-2026-73100Critical
Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests ending in a server error without redaction, so Authorization, Cookie, Proxy-Authorization and X-API-Key headers are written in cleartext to the application log.
- CVE-2026-73099Critical
Cross-Site Request Forgery (CSRF) vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body and is enabled by default on every HTTP method including GET, so a cross-site link can deliver an attacker-chosen request body without a CORS preflight.
- CVE-2026-73098Critical
Improper control of dynamically-loaded code vulnerability in Apache Juneau. When parsing a value into a property of type java.lang.Class, the default class swap loaded the named class with initialization enabled, so input naming a class on the application classpath ran that class's static initializer.
- CVE-2026-121489Critical
Path Traversal vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory; when an application enables the resource's view, upload or delete settings (all off by default), a client can read, write or delete files outside the root.
- CVE-2026-100109Critical
The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating users through an action available to unauthenticated visitors, and lets the caller choose the new account's role. This allows unauthenticated attackers to create administrator accounts and take over the site.
Original NVD description (English source)
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS