Critical RCE Vulnerability in s2Member Plugin for WordPress

## Overview The s2Member plugin for WordPress has a critical vulnerability, identified as CVE-2026-86596. This affects all versions up to and including 260927. The flaw allows authenticated attackers to execute remote code on the server. ## Technical Details The vulnerability arises from insufficient sanitization in the `strip_php_tags_deep()` function. This function only removes literal `<?` sequences. Additionally, a post-interpolation placeholder cleanup can reconstruct a valid `<?php` opener after the attacker-controlled value is embedded in the email template. This means that an attacker with custom-level access can manipulate the `item_name` parameter to execute arbitrary PHP code. ## Impact Successful exploitation of this vulnerability can lead to full server compromise. Attackers can run malicious code, potentially accessing sensitive data or taking control of the entire WordPress site. Given the high CVSS score of 9.8, this poses a significant risk to users of the s2Member plugin. ## Mitigation Defenders should immediately update the s2Member plugin to the latest version to mitigate this vulnerability. Regularly review and apply security patches for all plugins. Monitor server logs for any unusual activity that may indicate exploitation attempts.