Critical RCE Vulnerability in s2Member Plugin for WordPress

## Overview The s2Member plugin for WordPress has a critical vulnerability, CVE-2026-86596. This affects all versions up to and including 260927. The flaw allows authenticated attackers to execute arbitrary code on the server. ## Technical Details The vulnerability resides in the 'item_name' parameter. Insufficient sanitization in the function `strip_php_tags_deep()` only removes literal '<?' sequences. This is compounded by a post-interpolation placeholder cleanup that reconstructs a valid '<?php' opener. As a result, attackers can inject PHP code into email templates. Once embedded, the attacker can execute this code on the server. ## Impact Authenticated attackers with custom-level access or higher can exploit this vulnerability. Successful exploitation can lead to full control over the affected WordPress site. This could result in data theft, site defacement, or further compromise of connected systems. ## Mitigation Defenders should update the s2Member plugin to version 260928 or later immediately. Regularly check for updates and apply them promptly. Implement strict access controls to limit who can authenticate to the WordPress site. Additionally, consider monitoring for unusual activity that may indicate exploitation attempts.