Cevnitra
Cevnitra

Explore Cevnitra

Explore Cevnitra

Find the risk.
Focus the fix.

Bring your applications and infrastructure into focus.

Scan Now
Already have an account? Log in
All security reports
NVD security advisory

Security advisory for The s2Member plugin for WordPress

CVE-2026-86596

Full advisory details, affected packages, severity context, and original source.

Affected technology

The s2Member plugin for WordPressPHP ecosystem

Advisory overview

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.

Related references

Your vulnerabilities. One clear dashboard.

Find and review known vulnerabilities across your applications and infrastructure in one dashboard, so your team can see what needs attention and take action to fix it.

Create your account
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, | Security report | Cevnitra