Plugin CVE-2026-86596

s2Member CVE-2026-86596

s2Member 260927 and older has a critical remote code execution bug, CVE-2026-86596. Attacks were recorded on Nov 2, 2026. Update to 261001.

What happened

s2Member 260927 and older has a critical remote code execution bug, CVE-2026-86596. Wordfence rates it 9.8 and Patchstack rates it 10. It is reached through the PayPal IPN item_name parameter. Patchstack recorded attacks on Nov 2, so this one is already being exploited. It is the plugin's second code execution bug in about six weeks, after CVE-2026-19804 in September.

Who is affected

Any site still running the s2Member plugin at version 260927 or older.

Fixed version: 261001.

Do this now

  1. Update s2Member to 261001 or newer.
  2. If the site ran 260927 or older, check Users for administrators nobody recognizes.
  3. Look for PHP files that do not belong in the uploads folder and other writable folders.
  4. Change admin passwords if anything looks wrong.

Source: Wordfence advisory

You patched it. Now watch the site.

Pro adds a cloud firewall, malware scanning, and login protection. 14 days. Card or PayPal, not charged today.

Start 14-day Pro trial

Larger screenshot

Enlarged image