CVE-2026-86596

Summary

The s2Member WordPress plugin (≤260927) contains a Remote Code Execution (RCE) vulnerability in the 'item_name' parameter due to inadequate sanitization: strip_php_tags_deep() only removes literal '<?' sequences, and a subsequent placeholder cleanup reassembles '<?php' from attacker-controlled input embedded in email templates, enabling authenticated attackers with custom-level access or higher to execute arbitrary PHP code on the server.

Exploitability

Exploitation requires authentication with custom-level access or higher and is straightforward for such users, as no complex chaining or privilege escalation is needed beyond leveraging the vulnerable parameter.

Blast radius

Successful exploitation allows full compromise of the affected WordPress site, including data theft, defacement, or lateral movement within the hosting environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to s2Member version 260928 or later, which includes a fix for the insufficient sanitization in strip_php_tags_deep() and the post-interpolation placeholder cleanup logic.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.