AI analysis
Claude Opus · 7 Nov 2026, 10:21 CET
s2Member WordPress plugin flaw lets attackers run code via payment email templates
The s2Member WordPress plugin, all versions up to and including 260927, has a critical code injection flaw (CVSS 3.1: 9.8) reachable through the 'item_name' parameter. The record lists no fixed version, so check for an update and restrict exposure now.
In plain terms
s2Member is a WordPress plugin for membership sites and paid content, including payments processed through PayPal. Every version up to and including 260927 lets an attacker slip program code into a value called 'item_name', which ends up inside an email template the plugin builds. Because of a filtering mistake, that code can end up being run by the web server. This is called remote code execution: an attacker on the internet makes your server run commands of their choosing.
Anyone running a WordPress site with s2Member should treat this as urgent. Code running on the server usually means full control of the website, its database and any member or payment data it holds.