CVE-2026-86596
s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter
- Published
- Nov 2, 2026
- Updated
- Nov 2, 2026
- Assigning CNA
- Wordfence
- Evidence observed
- Nov 4, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLow · next 30 days
- Percentile
- 74.1%
- Model date
- Nov 4, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.
Sources
- CVE-2026-86596Exploit
Single-file exploit and mass scanner for CVE-2026-86596, an s2Member template-injection RCE via the PayPal IPN item_name parameter, with bypass variants and webshell deployment.
CVE-2026-86596 s2Member <= 260927 template-injection PoC (lab; IPN verification required)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.