---
id: "CVE-2026-86596"
kind: "vulnerability"
aliases: ["CVE-2026-86596"]
title: "s2Member WordPress plugin up to 260927: item_name parameter allows PHP code execution"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "s2member", "fixed": ["261001"], "affected": "<= 260927", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["poc-public", "s2member", "package", "wordpress", "self-hosted"]
not_affected_if: ["no-untrusted-accounts", "plugin-not-installed"]
published_at: "2026-11-02T22:17:23+00:00"
first_seen_at: "2026-11-02T22:35:43+00:00"
updated_at: "2026-11-02T23:06:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86596", "first_seen_at": "2026-11-02T22:35:43+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T22:38:40+00:00"}, {"source": "github-poc", "url": "https://github.com/thiscitze/cve-2026-86596-poc", "first_seen_at": "2026-11-02T23:06:42+00:00"}]
---

# s2Member WordPress plugin up to 260927: item_name parameter allows PHP code execution

The s2Member WordPress plugin fails to strip PHP opening tags from the item_name parameter, so a placeholder cleanup step rebuilds a PHP opener after the value is placed in an email template. An attacker with custom-level access or higher can run code on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:s2member affected <= 260927 fixed 261001

## How to check

- Run `wp plugin list` or check Plugins in wp-admin; s2Member version <= 260927 is affected, 261001 or later is fixed.
- Also check the Pro add-on (s2member-pro) is updated to a matching version; the vendor says versions must match the Framework.
- Review PayPal IPN logs for item_name values containing PHP tags.

## Fix

Update s2Member to 261001 or later (latest seen: 261017).

## Timeline

- 2026-11-02T22:35:43+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-86596
- 2026-11-02T22:38:40+00:00 analyst — Wordfence (CNA) advisory: fixed in 261001, affected <=260927. Wordfence title says Unauthenticated/IPN but description says custom-level+ auth; role threshold unclear, treat as possibly unauthenticated via PayPal IPN endpoint. s2member.com changelog page read only for latest versions (261017); 261001 entry not seen, so fix not marked verified. No exploitation/PoC found.
- 2026-11-02T23:06:42+00:00 github-poc https://github.com/thiscitze/cve-2026-86596-poc

## Documents

- [advisory] Wordfence: s2Member <= 260927 RCE via item_name IPN parameter https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/s2member/s2member-260927-unauthenticated-remote-code-execution-via-item-name-ipn-parameter
- [mentions] s2Member changelog https://s2member.com/changelog/
- [poc] thiscitze/cve-2026-86596-poc https://github.com/thiscitze/cve-2026-86596-poc

## From the sources

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_