CVE-2026-86596
CriticalCVSS 9.8Summary
The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.
Risk Assessment
An authenticated attacker with custom-level access and above can execute arbitrary code on the server, leading to full compromise of the WordPress installation.
Recommendation
Update the s2Member plugin to a version later than 260927 or temporarily disable it if an update is not available.
Other vulnerabilities in s2Member
See all- CVE-2025-62023Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member. This issue affects s2Member: from n/a through 250905.
- CVE-2026-15047Medium
The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post (stored XSS).
Original NVD description (English source)
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS