s2Member <= 260913 - Authenticated (Subscriber+) Remote Code Execution via Custom Profile Fields in Payment Notification Emails and Tracking Codes
- ID
- WPSEC-2026-0219
- Plugin
- s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (s2member)
- Affected
- all versions before 260917
- Remediation
- Update to 260917 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- s2Member on WPSec AttackSurface
- Fix released
- Published
Description
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260913. The PayPal payment notification emails sent for membership modifications and custom capability purchases, and the Modification and Capability tracking codes, were evaluated as PHP after their replacement codes had been filled in, and the values of a member's custom registration/profile fields were substituted without removing PHP tags. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary code on the server by saving PHP code in one of their own custom profile fields and then completing a payment, provided the site administrator has included that field's replacement code in one of these email templates or tracking codes (a documented feature).
References
- https://wpsec.com/vuln/WPSEC-2026-0219/
- https://plugins.svn.wordpress.org/s2member/tags/260917/
- https://wordpress.org/plugins/s2member/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS