S2Member Excellent For All Kinds Of Memberships Content Restriction Paywalls Member Access Subscriptions
Monthly
Remote code execution in the WordPress s2Member plugin (all versions up to and including 260814) lets unauthenticated attackers execute arbitrary PHP on the server by injecting code through the 'first_name' parameter, which is substituted unsanitized into an eval'd Signup Tracking Codes template. Exploitation is conditional rather than default-config: the site administrator must have configured a Signup Tracking Codes template containing the documented %%first_name%% placeholder, and the attacker must first obtain the site-global proxy verification key that s2Member exposes in plaintext in the JSON response of any PayPal Checkout AJAX request, which also permits bypassing PayPal postback verification. Both prerequisites together yield unauthenticated remote code execution with high attack complexity and no user interaction; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was provided.
Remote code execution in the WordPress s2Member plugin (all versions up to and including 260814) lets unauthenticated attackers execute arbitrary PHP on the server by injecting code through the 'first_name' parameter, which is substituted unsanitized into an eval'd Signup Tracking Codes template. Exploitation is conditional rather than default-config: the site administrator must have configured a Signup Tracking Codes template containing the documented %%first_name%% placeholder, and the attacker must first obtain the site-global proxy verification key that s2Member exposes in plaintext in the JSON response of any PayPal Checkout AJAX request, which also permits bypassing PayPal postback verification. Both prerequisites together yield unauthenticated remote code execution with high attack complexity and no user interaction; no public exploit code or CISA KEV listing was identified at time of analysis, and no EPSS score was provided.