# CVE-2026-86596: s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

- Exploited (CISA KEV): no
- Published: 2026-11-02
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: no score
- CWE: CWE-94

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '<?' sequences, combined with a post-interpolation placeholder cleanup that reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

15 posts seen since 2026-11-02.

- Exploit repository (unvetted): https://github.com/thiscitze/cve-2026-86596-poc
- bluesky 2026-11-02: 🔴 CVE-2026-86596 - Critical (9.8)  The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, a...  https://www.thehackerwire.com/vulnerability/CVE-2026-86596/  #infosec #cybersecurity #CVE #vulnerability #security #patchstack (https://bsky.app/profile/thehackerwire.bsky.social/post/3mzej3onqbn23)
- x 2026-11-03: 🚨 Update: public exploit code for CVE-2026-86596 is out on GitHub. No patch listed yet https://t.co/LdoqF5kJXr (https://x.com/cvedotnow/status/2117435991988281786)
- bluesky 2026-11-03: CVE-2026-86596: s2Member plugin (<=260927) faces CRITICAL RCE risk. Auth'd users with custom-level+ can execute code on WordPress sites. Restrict access or disable plugin until a patch is released. https://radar.offseq.com/threat/the-s2member-plugin-for-wordpress-is-vulnerable-t… (https://bsky.app/profile/offseq.bsky.social/post/3mzeouwsnfj2z)
- x 2026-11-03: NØØT Security Alerts  Classification: Critical CVE: CVE-2026-86596 Product: clavaque / s2member  Summary: VulnCheck reports real-world exploitation activity affecting clavaque / s2member.  Evidence: Active exploitation reported; Severe impact class  Impact: The vulnerability has (https://x.com/Python_s_/status/2117423601066361213)
- bluesky 2026-11-03: CVE-2026-86596: s2Member for WordPress is vulnerable to remote code execution. Severity is critical across all versions up to the advisory cutoff. (https://bsky.app/profile/veduis.bsky.social/post/3mzelsunuc32j)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-86596 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-86596