{"id":"CVE-2026-86596","kind":"vulnerability","aliases":["CVE-2026-86596"],"related":[],"title":"s2Member WordPress plugin up to 260927: item_name parameter allows PHP code execution","description":"The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.","summary":"The s2Member WordPress plugin fails to strip PHP opening tags from the item_name parameter, so a placeholder cleanup step rebuilds a PHP opener after the value is placed in an email template. An attacker with custom-level access or higher can run code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"s2member","fixed":["261001"],"affected":"<= 260927","ecosystem":"wordpress"}],"ecosystems":[],"tags":["poc-public","s2member","package","wordpress","self-hosted"],"not_affected_if":["no-untrusted-accounts","plugin-not-installed"],"how_to_check":"- Run `wp plugin list` or check Plugins in wp-admin; s2Member version <= 260927 is affected, 261001 or later is fixed.\n- Also check the Pro add-on (s2member-pro) is updated to a matching version; the vendor says versions must match the Framework.\n- Review PayPal IPN logs for item_name values containing PHP tags.","fix":"Update s2Member to 261001 or later (latest seen: 261017).","status":"open","published_at":"2026-11-02T22:17:23+00:00","first_seen_at":"2026-11-02T22:35:43+00:00","triaged_at":"2026-11-02T22:37:47+00:00","updated_at":"2026-11-02T23:06:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-02T22:37:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"s2Member WordPress plugin: item_name flaw lets authenticated users run server code","impact":"high","summary":"The s2Member WordPress plugin fails to strip PHP opening tags from the item_name parameter, so a placeholder cleanup step rebuilds a PHP opener after the value is placed in an email template. An attacker with custom-level access or higher can run code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","s2member","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the web server by an authenticated user","analyst_note":"Check the NVD entry and the plugin vendor's changelog for a fixed version and the exact role threshold.","how_to_check":"- Check whether the s2Member plugin is installed and which version is active in the WordPress plugins list or `wp plugin list`.\n- Confirm the version against the ranges in the NVD entry; the description says all versions up to and including `260927` are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-untrusted-accounts"],"who_is_affected":"Sites running the s2Member plugin for WordPress where users hold custom-level access or higher. The flaw sits in how item_name is embedded into email templates, so sites without s2Member can skip it. Sites that do not give accounts beyond subscriber-level roles are less exposed, though the sources do not state a precise role boundary beyond custom-level and above.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000711,"input_tokens":4213,"output_tokens":579,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin vendor's changelog for a fixed version and the exact role threshold.","search":"'-2026':15A,18A '-86596':16A,19A '260927':6A,96C 'access':69B,158C 'allow':10A 'alreadi':140C 'attack':64B,136C,153C 'attacker-control':135C 'authent':152C 'cleanup':48B,126C 'code':12A,74B,87C,163C 'combin':119C 'control':137C 'custom':67B,156C 'custom-level':66B,155C 'cve':14A,17A 'deep':113C 'due':105C 'email':61B,145C 'embed':142C 'execut':13A,88C,162C 'fail':34B 'higher':71B 'host':29B 'includ':95C 'insuffici':107C 'interpol':124C 'item':7A,42B,99C 'level':68B,157C 'liter':117C 'make':148C 'name':8A,43B,100C 'open':38B,53B,132C 'packag':25B 'paramet':9A,44B,101C,102C 'php':11A,37B,52B,111C,131C 'place':58B 'placehold':47B,125C 'plugin':3A,33B,80C 'poc':22B 'poc-publ':21B 'possibl':150C 'post':123C 'post-interpol':122C 'public':23B 'reassembl':128C 'rebuild':50B 'remot':86C 'run':73B 's2member':1A,20A,24B,31B,79C 'sanit':108C 'self':28B 'self-host':27B 'sequenc':118C 'server':77B,166C 'step':49B 'strip':36B,110C,116C 'tag':39B,112C 'templat':62B,146C 'valid':130C 'valu':56B,138C 'version':91C 'via':97C 'vulner':84C 'wordpress':2A,26B,32B,82C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the s2Member plugin at version 260927 or earlier, especially those using PayPal IPN notifications and email templates. Wordfence's description says custom-level access and above is required, but its title and CVSS vector (no privileges) describe it as unauthenticated, so treat any internet-facing site as exposed. Sites without s2Member can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["s2member"],"ptokens":["s2member"],"labels":["critical","package","pocpublic","s2member","selfhosted","wordpress"],"first_public_at":"2026-11-02T22:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-86596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86596","severity":null,"published_at":"2026-11-02T22:17:23+00:00","modified_at":"2026-11-02T22:17:23+00:00","first_seen_at":"2026-11-02T22:35:43+00:00","fetched_at":"2026-11-02T22:35:43+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-86596:1436","url":null,"severity":null,"published_at":"2026-11-02T22:38:40+00:00","modified_at":"2026-11-02T22:38:40+00:00","first_seen_at":"2026-11-02T22:38:40+00:00","fetched_at":"2026-11-02T22:38:40+00:00","note":"Wordfence (CNA) advisory: fixed in 261001, affected <=260927. Wordfence title says Unauthenticated/IPN but description says custom-level+ auth; role threshold unclear, treat as possibly unauthenticated via PayPal IPN endpoint. s2member.com changelog page read only for latest versions (261017); 261001 entry not seen, so fix not marked verified. No exploitation/PoC found."},{"source":"github-poc","external_id":"thiscitze/cve-2026-86596-poc","url":"https://github.com/thiscitze/cve-2026-86596-poc","severity":null,"published_at":"2026-11-02T22:57:32+00:00","modified_at":null,"first_seen_at":"2026-11-02T23:06:42+00:00","fetched_at":"2026-11-02T23:06:42+00:00","note":null}],"documents":[{"id":54253,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/s2member/s2member-260927-unauthenticated-remote-code-execution-via-item-name-ipn-parameter","title":"Wordfence: s2Member <= 260927 RCE via item_name IPN parameter","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":54254,"url":"https://s2member.com/changelog/","title":"s2Member changelog","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":54389,"url":"https://github.com/thiscitze/cve-2026-86596-poc","title":"thiscitze/cve-2026-86596-poc","kind":"poc","source":"github","publisher":null,"text":"CVE-2026-86596 s2Member <= 260927 template-injection PoC (lab; IPN verification required)\n\nstars 0","published_at":"2026-11-02T22:57:32+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}