s2Member CVE-2026-86596

Requires an authenticated account with s2Member 'custom-level' capability or above (per the description), so this is not an unauthenticated flaw despite the CVSS PR:N. The concrete trigger is a crafted 'item_name' parameter whose split PHP tag survives strip_php_tags_deep() (which strips only literal '<?') and is then reassembled into a valid '<?php' opener by a post-interpolation placeholder-cleanup step as the value is embedded in the plugin's email template (PayPal notification handling code paths). Limiting factors: the required custom-level-or-above authentication, and reliance on the specific sanitization/placeholder-reassembly flow present in versions up to and including 260927; environments without such membership accounts raise the bar to exploitation.

This is a genuine high-priority issue, corroborated by the vuln.today 'act_now' decision label and a Wordfence-reported RCE (CWE-94) in a WordPress plugin. The supplied CVSS is 9.8 with vector AV:N/AC:L/PR:N/UI:N, implying remote unauthenticated exploitation. However, there is a clear CONFLICT: the description explicitly states exploitation requires 'authenticated attackers, with custom-level access and above,' which contradicts PR:N. Authentication therefore appears to be required despite the CVSS vector showing PR:N - treat the headline 9.8 as likely inflated; a PR:L assessment lands nearer 8.8. No EPSS score, no CISA KEV listing, and no confirmed working exploit code were provided, so active-exploitation signals are absent; the urgency rests on the vendor/priority-feed assessment and the low attack complexity rather than observed in-the-wild activity. Net: a real, actionable RCE that warrants prompt patching, but the practical barrier of needing a custom-level-or-above account reduces the mass-exploitation profile versus a truly unauthenticated 9.8.

An attacker holding a custom-level (or higher) membership account submits a crafted 'item_name' value containing a split PHP tag; strip_php_tags_deep() removes only the literal '<?' sequence, and a later post-interpolation placeholder cleanup step reassembles a valid '<?php' opener after the attacker value is already embedded in the email template, yielding server-side PHP code execution. Low attack complexity (AC:L) and network reachability make the request trivial to deliver once authenticated. No confirmed public exploit code was provided, though Wordfence documents the flaw and the vulnerable code paths.