Summary
generated automatically from NVD dataThe s2Member plugin for WordPress, in all versions up to and including 260927, allows Remote Code Execution through the 'item_name' parameter. The function strip_php_tags_deep() removes only literal '<?' sequences, and a later placeholder cleanup step reassembles a valid '<?php' opener after the attacker-controlled value is already embedded in the email template. Authenticated attackers with custom-level access or higher can execute code on the server, and the flaw is rated CRITICAL with a CVSS v3.1 score of 9.8 (CWE-94).
NVD description
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.
In-depth analysis on cveo.tech
This CVE is covered in an article: context, affected versions and published fixes.
CVSS v3.1 Score
Information
- Published
- 2 nov. 2026
- Updated
- 2 nov. 2026
- Status
- Deferred
- Source
- security@wordfence.com
Weaknesses (CWE)
References (9)
Similar CVEs
Other vulnerabilities of type CWE-94
Know which CVEs hit the versions you run.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.