s2Member for WordPress: critical RCE in versions up to 260927

What it is and who is affectedThe National Vulnerability Database (NVD) of NIST has published CVE-2026-86596, a remote code execution vulnerability in...

What it is and who is affected

The National Vulnerability Database (NVD) of NIST has published CVE-2026-86596, a remote code execution vulnerability in the s2Member plugin for WordPress. The affected range is broad: all versions up to and including 260927.

The flaw is classified as CWE-94 (improper control of code generation) and carries a CVSS 3.1 score of 9.8, rated CRITICAL, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practice, that means an attacker can reach the vulnerable component over the network, with no special conditions and no user interaction, and obtain a high impact on confidentiality, integrity and availability.

According to the NVD description, the entry point is the item_name parameter. The plugin's strip_php_tags_deep() function only removes literal opening sequences, and a subsequent clean-up step that runs after the value has already been interpolated into the email template ends up reassembling a valid PHP opening tag. The result is that an authenticated attacker with custom-level access or above can execute code on the server. The published references point to several files of the plugin, including the PayPal notification handlers and the utilities class.

s2Member is a membership and content-restriction plugin, so it tends to sit on sites that handle subscriptions, protected content and user data — exactly the kind of WordPress installation that a small business in Barcelona, Lleida, Tarragona or Girona might run without a dedicated security team watching it.

Why it matters even without active exploitation

At the time of writing, CVE-2026-86596 does not appear in CISA's KEV catalogue, and there is no public record that it is being exploited in the wild. That is good news, but it is not a reason to wait.

A 9.8 CRITICAL score on a plugin that grants code execution is the kind of issue that tends to attract attention quickly once proof-of-concept details circulate. The attack surface is a public-facing WordPress site, the requirement is an authenticated account at custom level or above, and the reward is full control of the server. For an online shop or a membership site, that combination is a direct route to data theft, defacement, malware injection or use of the server as a launchpad for further attacks — all of which carry GDPR consequences if personal data is exposed.

Because the vulnerability lives in a plugin rather than in WordPress core, it will not disappear with a routine core update. It has to be tracked and closed explicitly.

What to do today

Check whether s2Member is installed and which version you run. If the version is 260927 or lower, you are in the affected range. Confirm it on every site, including staging copies and older installations that are still reachable from the internet.
Apply the fix indicated in the vendor's advisory. The NVD entry does not state which release corrects the issue, so the correct source for the patched version, or for any interim mitigation, is the plugin vendor's own security notice. Do not assume that a higher version number is safe without checking it against that notice.
If no fix is available yet, reduce exposure. Consider disabling the plugin until a corrected release exists, and review which accounts hold custom-level access or above — the flaw requires an authenticated user at that level, so tightening roles and removing dormant accounts limits who could trigger it.
Look for signs of intrusion. Review server and WordPress logs for unexpected POST requests carrying the item_name parameter, for new or modified PHP files in the uploads directory, and for outbound connections you cannot explain. Compare file integrity against a known-good backup.
Shrink what is exposed to the internet. Remove or restrict access to staging environments, keep the WordPress admin behind additional authentication, and make sure the server, PHP and database layers are patched and hardened.

How a cybersecurity team such as ALMC's can help

Keeping track of plugin advisories across a handful of WordPress, PrestaShop or Joomla sites is a job in itself, and it is usually the first thing to slip when a small IT team is busy with day-to-day support. This is where an external security partner fits naturally.

At ALMC we work on exactly this layer: security audits and pentesting to find vulnerabilities before someone else does, server hardening, monitoring and incident response, and maintenance and updating of WordPress, PrestaShop and Joomla installations. When a site has already been compromised, we also handle the clean-up and repair of hacked websites, and we help close the gaps that allowed it in the first place.

For a business in Catalonia running its own servers or a lean IT department, the practical value is simple: someone is watching the advisories, checking versions against them and acting on the ones that matter — like CVE-2026-86596 — before they become an incident.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.