Patch Ticker

s2Member WordPress plugin remote code execution flaw

A WordPress membership tool lets higher-level members hack the server!

Summary

A flaw in how the s2Member WordPress plugin handles the 'item_name' value lets an authenticated member run code on the server. All versions up to and including 260927 are affected.

Affected when

  • Authenticated account at custom level or higher

What to do

No fixed version is named in the sources. Check that the installed s2Member is newer than 260927 and read the vendor's advisory.

Products and platforms

  • s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions

CVE IDs

Sources

Times

First published

First seen