Live › vulnerability › CVE-2026-86596
The s2Member WordPress plugin fails to strip PHP opening tags from the item_name parameter, so a placeholder cleanup step rebuilds a PHP opener after the value is placed in an email template. An attacker with custom-level access or higher can run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 22:35 UTC. All times on this page are UTC.
WordPress sites running the s2Member plugin at version 260927 or earlier, especially those using PayPal IPN notifications and email templates. Wordfence's description says custom-level access and above is required, but its title and CVSS vector (no privileges) describe it as unauthenticated, so treat any internet-facing site as exposed. Sites without s2Member can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| s2member | wordpress | <= 260927 | 261001 |
wp plugin list or check Plugins in wp-admin; s2Member version <= 260927 is affected, 261001 or later is fixed.Update s2Member to 261001 or later (latest seen: 261017).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-86596")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.