CVE-2026-19804 in s2Member Plugin
Summary
by MITRE • 09/25/2026
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The s2Member plugin for WordPress contains a critical Remote Code Execution vulnerability affecting all versions up to 260814. This flaw arises from insufficient input sanitization within the first_name parameter processing logic, specifically involving the esc_refs function which is designed to strip regex backreferences but fails to neutralize PHP tags before substitution into an eval'd Signup Tracking Codes template. The operational impact of this vulnerability allows unauthenticated attackers to execute arbitrary code on the target server under specific conditions where a site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder, which is a documented and GUI-supported feature within the plugin interface.
The technical mechanism behind this exploitation relies on two distinct but complementary weaknesses in the application's security architecture. First, the esc_refs function performs partial sanitization by removing regex backreferences while leaving PHP opening and closing tags intact when they are embedded within user-supplied input such as a first name field during registration or profile updates. Second, there is a significant information disclosure vulnerability wherein the site-global proxy verification key required for PayPal postback verification is exposed in plaintext within the JSON response of any standard PayPal Checkout AJAX request on the target website. This exposure allows attackers to bypass payment verification checks and facilitates further exploitation steps that rely on valid authentication tokens or session contexts associated with financial transactions.
Successful exploitation requires an attacker to first obtain this proxy verification key through a simple HTTP GET request to the PayPal checkout endpoint, which returns sensitive configuration data without requiring any form of authentication. With access to this key, combined with the ability to inject malicious PHP code via the unsanitized first_name parameter into the eval'd template context, attackers can achieve full remote code execution on the web server hosting the WordPress instance. This represents a severe security risk as it grants complete control over the underlying operating system processes running under the web server user privileges, potentially leading to data exfiltration, lateral movement within internal networks, and persistent backdoor installation.
From an industry standards perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) due to the execution of injected PHP code via eval, as well as CWE-200 Exposure of Sensitive Information to an Unauthorized Actor regarding the plaintext disclosure of the proxy verification key. In terms of MITRE ATT&CK mapping, this scenario corresponds to T1190 Exploit Public-Facing Application for initial access and potentially T1505.003 Server Software Component: Web Shell if persistent code execution is established through uploaded or injected scripts. The combination of input validation failure and credential exposure creates a high-severity attack vector that does not require user interaction beyond visiting the checkout page, making it particularly dangerous in public-facing environments.
Mitigation strategies should prioritize immediate patching to the latest version of s2Member where these sanitization issues have been addressed by developers who likely implemented stricter input filtering or replaced eval-based template rendering with safer alternatives such as str_replace combined with output escaping functions like esc_html or wp_kses_post depending on context. Administrators unable to update immediately should consider disabling PayPal checkout functionality temporarily if not strictly required, thereby removing the attack surface associated with the exposed proxy key. Additionally, implementing Web Application Firewall rules that detect and block PHP tag injection attempts in form fields can provide a layer of defense against exploitation while updates are being deployed. Regular security audits focusing on input validation practices across all user-facing parameters are recommended to prevent similar code injection vulnerabilities from arising in other parts of the application ecosystem.