CVE-2026-86596criticalobserved exploitationCWE-94

CVE-2026-86596: critical vulnerability in clavaque s2Member – Excellent for All Kinds of…

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

Published

Follow this CVE+ Monitor s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.8epss 1.5%
from disclosure to weaponsame day
Published on NVDNov 2
1st PoCNov 2
VulnCheckNov 2
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
clavaque · s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — clavaque s2Member – Excellent for All Kinds of…

In the same product, most dangerous first.

CVE-2026-19804HIGHs2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy ReturnEPSS 1.0%CVE-2024-8326HIGHs2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241114 - Authenticated (Contributor+) Sensitive Information ExposureEPSS 0.6%CVE-2024-0899MEDIUMs2Member – Best Membership Plugin for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 230815 - Information ExposureEPSS 0.6%CVE-2024-11376MEDIUMs2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions <= 241216 - Reflected Cross-Site ScriptingEPSS 0.4%CVE-2026-1994CRITICALs2Member <= 260127 - Unauthenticated Privilege Escalation via Account TakeoverEPSS 0.4%CVE-2025-13732MEDIUMs2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%