Remote Code Execution in s2Member WordPress Plugin

The s2Member plugin for WordPress (versions 260814 and earlier) contains a critical remote code execution (RCE) vulnerability identified as CVE-2026-19804. The flaw exists within the Signup Tracking Codes template functionality. If a site administrator has configured this template to use the %%first_name%% placeholder, user input submitted to the 'first_name' parameter is passed through an unsafe 'eval' function without sufficient sanitization. The esc_refs() function fails to strip PHP tags, enabling arbitrary PHP code injection.

Successful exploitation requires two conditions: the site must have an active Signup Tracking Codes template containing the specified placeholder, and the attacker must obtain the site-global proxy verification key. This key is disclosed in plaintext within the JSON response of any PayPal Checkout AJAX request on the affected site. This vulnerability allows an unauthenticated attacker to execute code in the context of the web server.

Attack Chain

1. Attacker monitors public-facing traffic for PayPal Checkout AJAX requests on the target site.
2. Attacker intercepts the JSON response to capture the plaintext site-global proxy verification key.
3. Attacker identifies a site where the s2Member plugin is configured with a Signup Tracking Codes template using the %%first_name%% placeholder.
4. Attacker crafts a malicious payload containing PHP tags and injects it into the 'first_name' parameter.
5. The plugin fails to sanitize the malicious input, passing the payload directly into an eval-based template substitution process.
6. The server interprets the injected PHP code, executing it with the privileges of the web server process.
7. Attacker gains unauthorized remote code execution, potentially leading to total system compromise or further lateral movement.

Impact

Successful exploitation results in full unauthenticated remote code execution on the WordPress server. This allows for data exfiltration, modification of site content, installation of backdoors, or pivoting into the internal network. The scope of impact includes any WordPress instance using the vulnerable s2Member plugin versions up to 260814 with the documented Signup Tracking Codes feature enabled.

Recommendation

Prioritize the immediate update of the s2Member plugin to a version beyond 260814 that addresses CVE-2026-19804. Monitor web server logs for HTTP POST requests to s2Member endpoints containing PHP syntax in the 'first_name' field. Investigate logs for unauthorized access to PayPal Checkout AJAX responses, which may indicate an attacker harvesting proxy verification keys. Implement a Web Application Firewall (WAF) rule to block common PHP tag sequences (e.g., <?php, <?) within the 'first_name' parameter for this specific plugin.