{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-86596","assignerOrgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","state":"PUBLISHED","assignerShortName":"Wordfence","dateReserved":"2026-09-08T08:18:31.098Z","datePublished":"2026-11-02T21:30:23.199Z","dateUpdated":"2026-11-02T21:30:23.199Z"},"containers":{"cna":{"providerMetadata":{"orgId":"b15e7b5b-3da4-40ae-a43c-f7aa60e62599","shortName":"Wordfence","dateUpdated":"2026-11-02T21:30:23.199Z"},"affected":[{"vendor":"clavaque","product":"s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","versions":[{"version":"0","status":"affected","lessThanOrEqual":"260927","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server."}],"title":"s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe64cd3-c5ca-4867-90de-4784510a1126?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utilities.inc.php#L49"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L138"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L131"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L104"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utils-strings.inc.php#L201"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in.inc.php#L49"},{"url":"https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-subscr-or-wa-w-level.inc.php#L514"},{"url":"https://plugins.trac.wordpress.org/changeset/3722434/s2member"}],"problemTypes":[{"descriptions":[{"lang":"en","description":"CWE-94 Improper Control of Generation of Code","cweId":"CWE-94","type":"CWE"}]}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"}}],"credits":[{"lang":"en","type":"finder","value":"khanhnv"}],"timeline":[{"time":"2026-10-14T04:20:37.000Z","lang":"en","value":"Vendor Notified"},{"time":"2026-11-02T08:59:41.000Z","lang":"en","value":"Disclosed"}]}}}