CVE-2026-86596 Details
Description
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.
A remote code execution vulnerability exists in the s2Member plugin for WordPress, affecting all versions through 260927. The issue arises from inadequate sanitization of the 'item_name' parameter in the PayPal IPN notification process. The function strip_php_tags_deep() only removes literal '<?' sequences, allowing authenticated attackers with custom-level access and above to inject PHP code that is executed on the server. This exploitation is possible because a placeholder cleanup process reintroduces a valid '<?php' tag after the malicious value has been inserted into an email template, bypassing security measures.
Users are advised to update the s2Member plugin to version 261001 or a newer patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 2, 2026CISA-ADP
Assessed Nov 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| s2Member | <= 260927 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 8, 2026 | CVE Modified | CISA-ADP |
| Nov 2, 2026 | New CVE Received | [email protected] |