A critical code injection flaw in the s2Member WordPress plugin, affecting all versions up to and including 260927, can let attackers run arbitrary code on the server through the item_name parameter.
What Is It
CVE-2026-86596 is a remote code execution vulnerability in the s2Member membership plugin for WordPress, published on 2026-11-02 and classified as CWE-94 (Code Injection). The cause is weak sanitization in the plugin's strip_php_tags_deep() function, which removes only literal <? sequences. After the attacker-controlled item_name value is placed into an email template, a later placeholder cleanup step puts a valid <?php opener back together. The result is PHP code the attacker controls, running on the server.
Wordfence's description says the attacker must be authenticated with custom-level access or above. The CVSS v3.1 vector it assigned, however, lists Privileges Required as None (PR:N). Defenders should keep both in mind when assessing exposure.
Why It Matters
Wordfence rated the flaw CVSS 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. It can be exploited over the network with low complexity and no user interaction. Success means a full loss of confidentiality, integrity and availability on the affected server. Code execution on a WordPress host usually means the site is fully compromised.
The cited sources do not confirm active exploitation. NVD lists the record's status as "Deferred."
What's Vulnerable
- Vendor: clavaque
- Product: s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (WordPress plugin)
- Affected versions: All versions up to and including 260927
The NVD references point to the plugin's PayPal notification handlers (paypal-notify-in.inc.php, paypal-notify-in-web-accept-sp.inc.php, paypal-notify-in-subscr-or-wa-w-level.inc.php) and its string utility classes as the relevant code paths.
Patch Status
The NVD record references a WordPress plugin changeset (3722434) for s2Member, which suggests a code fix has been committed. The cited sources do not name a fixed version. Administrators should update s2Member to the latest release above 260927 and check the version against the Wordfence advisory.