On this page (7 sections)
A critical code injection flaw has been published for s2Member, a WordPress membership plugin. Tracked as CVE-2026-86596, it affects all versions up to and including 260927 and can let an authenticated user with custom-level access or higher execute code on the server, according to the NVD record.
If you run a membership, paywall or subscription site on WordPress with s2Member installed, treat this as a priority to review. At the time of writing, only the NVD entry and its linked references describe the issue, so some details, such as a fixed version, are not confirmed.
What happened
The NVD entry, published on 2026-11-02, describes remote code execution in s2Member through the 'item_name' parameter. The attacker must be authenticated with custom-level access or above, so this is not described as a fully anonymous attack. The score of 9.8 reflects the severity of the outcome: code running on the web server.
Only one independent publisher covers the story so far. The record also links to a Wordfence threat intelligence entry and a WordPress plugin repository changeset, which are the places to look for details beyond the NVD description.
Technical details in plain terms
The weakness is classified as CWE-94, improper control of generated code. The NVD description explains the cause in two parts:
- A function named strip_php_tags_deep() is meant to clean user-supplied values, but it only removes literal '<?' sequences.
- A placeholder cleanup step runs after the attacker-controlled value has already been embedded in an email template. According to the description, that cleanup reassembles a valid '<?php' opener.
In other words, the filter runs at the wrong moment. Sanitizing input and then modifying the text again afterwards can undo the protection. This is a common class of bug: a defense checks the data before a later transformation changes what the data means.
The reference links point to s2Member source files, and several of those file names mention PayPal notifications. The NVD description itself does not mention PayPal, and the exact request path that reaches the flaw is not confirmed in the sources available. We are not describing how to build a request that triggers it.
Who is affected
Every site running s2Member at version 260927 or earlier is within the affected range. Real-world risk depends on who can hold an account with custom-level access or above. The sources available do not explain how such access is granted in a default s2Member setup, so do not assume ordinary members or open registrations do or do not qualify. Check which of your roles meet that level and who holds them.
Weak or reused passwords on those accounts also raise the risk, since the attacker needs a valid login at the required level.
How to check your exposure
First, find out whether s2Member is installed and which version it is. This read-only WP-CLI command lists the plugin with its status and version. Run it from your WordPress root directory and look for a version of 260927 or lower.
wp plugin list --name=s2member --fields=name,status,versionIf you do not have shell access, open Plugins in the WordPress dashboard and read the version number under s2Member.
Next, see which roles exist on your site. This read-only command lists all roles; note any custom roles, including those added by s2Member, and compare them against the custom-level requirement in the advisory.
wp role listThen list the users holding a role you want to review. Replace YOUR_ROLE with a role name from the previous output; the result shows each account, and you should look for any you do not recognize.
wp user list --role=YOUR_ROLE --fields=ID,user_login,user_email,user_registeredYou can also check our list of known WordPress plugin vulnerabilities and read our guide on whether your plugin is vulnerable.
What to do now
The NVD record does not name a patched version, so confirm the current state of the plugin before relying on an update. Check the Wordfence entry and the plugin changeset for fix information.
0 of 8 done
If the plugin must stay active, a web application firewall can add a layer of protection, but it is not a substitute for patching. See what a WAF is for what it can and cannot do.
Detection and monitoring
Because the flaw ends in code execution, look for unexpected or modified PHP files. This read-only command lists PHP files under wp-content changed in the last 7 days. Run it from the WordPress root and investigate anything you did not change yourself.
find wp-content -type f -name '*.php' -mtime -7 -printAlso review newly created administrator accounts, unexpected scheduled tasks, and web server logs for unusual requests from logged-in accounts at custom level or above, particularly around the time of any unexplained file changes. Our guides on checking if a website is hacked and what to do if you are hacked cover next steps. The free malware scanner can give an outside-in check, with the limits described in what outside-in detection can and cannot see.
What is still unknown
- The NVD record does not state a fixed version.
- No exploitation in the wild is reported in the sources available, and the CVE is not listed in CISA KEV at this time.
- The sources available do not say which party assigned the 9.8 score.
- The exact request path and how custom-level access is granted in typical setups are not explained.
- Independent coverage is limited, so details may change as vendors and researchers publish more.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.