Cpe:2.3:a:s2member:excellent_for_all_kinds_of_memberships_content_restriction_paywalls_member_access_subscriptions:*:*:*:*:*:*:*:*

An unauthenticated remote code execution vulnerability (CVE-2026-19804) exists in the s2Member WordPress plugin, allowing attackers to execute code via the first_name parameter when combined with a leaked proxy verification key.