---
id: CVE-2026-86596
title: >-
  s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN
  Parameter
summary: >-
  The s2Member plugin for WordPress is vulnerable to Remote Code Execution in
  all versions up to, and including, <= 260927 via the 'item_name' parameter
  parameter. This is due to insufficient sanitization in strip_php_tags_deep(),
  which on…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: clavaque
product: >-
  s2Member – Excellent for All Kinds of Memberships, Content Restriction
  Paywalls & Member Access Subscriptions
affected:
  - >-
    s2member_excellent_for_all_kinds_of_memberships_content_restriction_paywalls_member_access_subscriptions
    <= 260927
exploitAvailable: true
published: '2026-11-02'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T21:30:23.199Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-86596'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/bbe64cd3-c5ca-4867-90de-4784510a1126?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utilities.inc.php#L49
  - url: >-
      https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L138
  - url: >-
      https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L131
  - url: >-
      https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-web-accept-sp.inc.php#L104
  - url: >-
      https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/utils-strings.inc.php#L201
  - url: >-
      https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in.inc.php#L49
  - url: >-
      https://plugins.trac.wordpress.org/browser/s2member/tags/260829/src/includes/classes/paypal-notify-in-subscr-or-wa-w-level.inc.php#L514
  - url: 'https://plugins.trac.wordpress.org/changeset/3722434/s2member'
tags:
  - cve.org
  - exploit-available
epss: 0.01487
epssPercentile: 0.74201
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/Aureels/CVE-2026-86596'
    - 'https://github.com/thiscitze/cve-2026-86596-poc'
  checkedAt: '2026-11-07T18:34:43.521Z'
ingestedAt: '2026-11-05T19:30:42.858Z'
---

## Overview

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.

## Affected

- `s2member_excellent_for_all_kinds_of_memberships_content_restriction_paywalls_member_access_subscriptions <= 260927`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.