CVE-2026-86596
s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
CRITICAL 9.8EPSS 1.5%
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.
- Affected
- clavaque · s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
- CVSS v3.1 WORDFENCE
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.49% chance of exploitation in the next 30 days, 74th percentile
- Published
- 2026-11-02
Proof-of-concept exploits (1)
- thiscitze/cve-2026-86596-pocRepo stars 0★ · pushed 2026-11-02 · snapshot
1 file
CVE references
- https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/payp…REFERENCE
- https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/payp…REFERENCE
- https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/payp…REFERENCE
- https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/payp…REFERENCE
- https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/payp…REFERENCE
- https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/util…REFERENCE
- https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/util…REFERENCE
- https://plugins.trac.wordpress.org/changeset/3722434/s2memberREFERENCE
- https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe64cd3-c5ca-4867-90de-4784510…REFERENCE