CYBUNKR

s2Member WordPress plugin flaw lets attackers run code via PayPal payment messages, and exploit code is out

Published

CVE-2026-86596 in the s2Member membership plugin for WordPress, rated 9.8 out of 10, can let an attacker run code on your site through a PayPal payment notification. Exploit code went public on 2 November. Update to 261017.

If your WordPress site uses s2Member to run paid memberships or members-only content, update it today. CVE-2026-86596, rated 9.8 out of 10, can let an attacker run code on your server (CVE record). That means full control of the site and often the hosting account.

The bug is in how s2Member builds the email it sends after a PayPal payment. Its filter only removes the literal <? from the payment's item name, and a later clean-up step stitches a working <?php back together, so PHP code hidden in the item name runs on the server (CVE record).

Who is affected

  • s2Member 260927 and earlier (CVE record, Wordfence).
  • Version 261017, released on 17 October, is the current release. It rebuilds how PayPal payment emails are filled in, inserting the payment values once into the original template (261017 source, WordPress.org).
  • WordPress.org lists the plugin on more than 8,000 active sites (WordPress.org).

What has been seen so far

A snapshot from 3 November:

  • The CVE was published on 2 November. Its 9.8 score assumes no login is needed, although the record's text mentions an account with custom-level access (CVE record).
  • Late on 2 November an exploit script appeared on GitHub that writes a test PHP file into the WordPress folder (thiscitze). CIRCL's Vulnerability-Lookup logged it the same night. Its author notes that s2Member checks payment messages with PayPal or a secret verification key, so a simply forged message is normally rejected (thiscitze).
  • We have found no report of exploitation in the wild yet, and it is not in CISA's Known Exploited Vulnerabilities catalog.

Unverified exploit code is sometimes laced with malware, so don't run it to test your own site.

What to do

  • Update s2Member to 261017 or later from Plugins in the WordPress admin, or ask whoever looks after your site. If you don't use it, deactivate and delete it.
  • Keep the PayPal proxy verification key private. It appears in s2Member's button settings; if it has been shared or pasted anywhere public, treat the site as at risk until it is updated.
  • Check for dropped files, even after updating: look for unexpected .php files in the WordPress root and wp-content/uploads/, and for new admin users.
  • If you find signs of compromise, restore from a clean backup, then change admin, database, hosting and PayPal API passwords.

How we can help

Worried your membership site has been tampered with? Get in touch.

Sources