{"basis":"claimed","id":"CVE-2026-86596","name":"s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter","vendorProject":"clavaque","product":"s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions","publishedAt":"2026-11-02","cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"exploited":null,"epss":null,"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":"s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter","description":"The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.","cwes":["CWE-94"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:05:13.945Z","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","ssvc":null,"measured":[],"social":{"total":15,"first_seen":"2026-11-02T22:00:09.000Z","daily":[{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":8},{"day":"2026-11-03","posts":7}],"top_posts":[{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/thehackerwire.bsky.social/post/3mzej3onqbn23","author":"thehackerwire.bsky.social","author_name":"TheHackerWire","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:yhhqv2c64q5xv7mdwy6dbwqq/bafkreibnofwla3zl6epzaubi52gnzfchkqufk3k3eaktsy4ibsm7dtemeu","text":"🔴 CVE-2026-86596 - Critical (9.8)\n\nThe s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, a...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-86596/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack","engagement":1,"posted_at":"2026-11-02T23:47:02.000Z"},{"source":"x","kind":"post","url":"https://x.com/cvedotnow/status/2117435991988281786","author":"cvedotnow","author_name":"cve.now","avatar_url":"https://pbs.twimg.com/profile_images/2114469817906577408/drWsbSgs_bigger.jpg","text":"🚨 Update: public exploit code for CVE-2026-86596 is out on GitHub.\nNo patch listed yet\nhttps://t.co/LdoqF5kJXr","engagement":0,"posted_at":"2026-11-03T01:57:35.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/offseq.bsky.social/post/3mzeouwsnfj2z","author":"offseq.bsky.social","author_name":"OffSequence","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:t5t6qep2vfipbi7f54demwev/bafkreidebkfyrafvzjuwvw3cnk6moxf6uzeg7hiubsqkthg653tnlrobxm","text":"CVE-2026-86596: s2Member plugin (<=260927) faces CRITICAL RCE risk. Auth'd users with custom-level+ can execute code on WordPress sites. Restrict access or disable plugin until a patch is released. https://radar.offseq.com/threat/the-s2member-plugin-for-wordpress-is-vulnerable-t…","engagement":0,"posted_at":"2026-11-03T01:30:39.613Z"},{"source":"x","kind":"post","url":"https://x.com/Python_s_/status/2117423601066361213","author":"Python_s_","author_name":"♫Why♥Not♪","avatar_url":"https://pbs.twimg.com/profile_images/2074222774751531009/3gDHjsZk_bigger.jpg","text":"NØØT Security Alerts\n\nClassification: Critical\nCVE: CVE-2026-86596\nProduct: clavaque / s2member\n\nSummary:\nVulnCheck reports real-world exploitation activity affecting clavaque / s2member.\n\nEvidence:\nActive exploitation reported; Severe impact class\n\nImpact:\nThe vulnerability has","engagement":0,"posted_at":"2026-11-03T01:08:20.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/veduis.bsky.social/post/3mzelsunuc32j","author":"veduis.bsky.social","author_name":"Veduis","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:ismjxguhz6v4xhywwowon2ym/bafkreidgaz5fcckikwhgt53cw3s7vvewzajul2blcbyhlypmjfjps4zw6u","text":"CVE-2026-86596: s2Member for WordPress is vulnerable to remote code execution. Severity is critical across all versions up to the advisory cutoff.","engagement":0,"posted_at":"2026-11-03T00:35:48.534Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/stackflag.bsky.social/post/3mzekwqdkmo2y","author":"stackflag.bsky.social","author_name":"STACKFLAG","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:zhe53h7ajlloep2oso5pqxzj/bafkreigtuhh5jkztpd2jbpwmsgwljrln6miskcl62es3xsgiziejo5gdve","text":"CVE-2026-86596 - s2member – excellent for all kinds of memberships, content restriction paywalls & member access subscriptions\nThe s2Member add‑on for WordPress can let a user who is signed in with a member‑level…\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#clava…","engagement":0,"posted_at":"2026-11-03T00:20:00.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/stemshop.bsky.social/post/3mzekael4zm2p","author":"stemshop.bsky.social","author_name":"stemshop.bsky.social","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:6zpzsab44xavrl46jqvba5wb/bafkreid2zcmne7vr45ck2bkvmhnf4occned3jmavshzk2fh5j5qpbtluja","text":"🚨 CVE-2026-86596 — CVSS 9.8 CRITICAL\n\nThe s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi...\n\n🔎 https://stemshop.top/cve/CVE-2026-86596\n\n#CVE #CyberSecurity #InfoSec","engagement":0,"posted_at":"2026-11-03T00:07:33.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/pulse-wp.com/post/3mzejtirs2f2b","author":"pulse-wp.com","author_name":"Pulse WP","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:m7puovzqhxurz66hip2xwfs6/bafkreig4pbmcjrypsx7kobfgwxzjnnqnkkffnvng6cyizvfzug6rhmo56u","text":"CVE-2026-86596. s2Member RCE. 9.8/10. Any visitor executes code on your server. wp-config exposed. Database credentials stolen. No patch available. Disable the plugin immediately. Scan your WordPress site: pulse-wp.com\n#WordPress #RCE #CyberSecurity","engagement":0,"posted_at":"2026-11-03T00:00:22.671Z"},{"source":"mastodon","kind":"post","url":"https://mastodon.social/@thehackerwire/117549511489199978","author":"thehackerwire","author_name":"TheHackerWire","avatar_url":"https://files.mastodon.social/accounts/avatars/115/755/483/699/003/887/original/be4cc997d460de98.jpg","text":"🔴 CVE-2026-86596 - Critical (9.8) The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, &lt;= 260927 via the &#039;item_name&#039; parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), wh…","engagement":0,"posted_at":"2026-11-02T23:46:40.223Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/cve.skyfleet.blue/post/i4eh2hspr2rmt","author":"cve.skyfleet.blue","author_name":"CVE Alerts ","avatar_url":"https://cdn.bsky.app/img/avatar/plain/did:plc:myutg2pwkjbukv7pq2hp5mtl/bafkreidzrx72dabuipp2ej2gldupqzv5nbtbez7tv4n26ekzjsot6ocdam","text":"CVE-2026-86596 - s2Member\nCVE ID : CVE-2026-86596\n \n Published : Nov. 2, 2026, 10:17 p.m. | 46 minutes ago\n \n Description : The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, &lt;= 260927 via the 'item_name' parameter...","engagement":0,"posted_at":"2026-11-02T23:36:20.556Z"},{"source":"x","kind":"post","url":"https://x.com/EnclaveRadar/status/2117399020129685699","author":"EnclaveRadar","author_name":"Enclave Radar","avatar_url":"https://pbs.twimg.com/profile_images/2116963272138121217/F3O3nWOo_bigger.jpg","text":"🆕 New CVE: CVE-2026-86596 (CVSS 9.8)\nclavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions · Remote code execution\nRemote, no login needed.\n\nThe s2Member plugin for WordPress is…\n\nhttps://t.co/4iF6yr7WT1","engagement":0,"posted_at":"2026-11-02T23:30:40.000Z"},{"source":"x","kind":"post","url":"https://x.com/thiscitze/status/2117393690620493997","author":"thiscitze","author_name":"3rl","avatar_url":"https://pbs.twimg.com/profile_images/2047702401038114816/8VBaN0TS_bigger.jpg","text":"cve-2026-86596\n\nhttps://t.co/2OXNEaFlF8","engagement":0,"posted_at":"2026-11-02T23:09:29.000Z"}],"exploit_repositories":[{"source":"github","kind":"poc","url":"https://github.com/thiscitze/cve-2026-86596-poc","author":"thiscitze","author_name":null,"avatar_url":"https://avatars.githubusercontent.com/u/277468862?v=4","text":"thiscitze/cve-2026-86596-poc: CVE-2026-86596 s2Member <= 260927 template-injection PoC (lab; IPN verification required)","engagement":0,"posted_at":"2026-11-02T22:57:32.000Z"}]}}