Wordfence published a CVSS 9.8 code execution flaw in s2Member on 2 November. The plugin is patched, but membership sites that never update plugins by hand are still sitting on the vulnerable builds.
What happened
The flaw is in s2Member's PayPal instant payment notification handler. A request carrying the plugin's IPN marker has its payment fields read and passed through a sanitiser that removes only literal opening PHP tags. The value of the item_name field is then written into a notification or tracking template. A later placeholder-cleanup pass strips whatever placeholder text remains inside that inserted value, and in doing so can join the surviving characters back into a working PHP opener. Once the template is evaluated, that is code execution as the web server user.
The CVE record itself is inconsistent about the entry condition, with Wordfence's title describing an unauthenticated path while the description text refers to custom-level access. Tracked as CVE-2026-86596, it is fixed in build 261001.
Who is affected
WordPress membership and paywall sites running s2Member:
- Every build up to and including 260927 is affected, which is a long tail of installs that froze on an older build.
- The reachable code path is the PayPal IPN handler, so sites that take PayPal payments through the plugin carry the practical exposure.
- Sites that already run 261001 or later are patched.
What to do now
Update s2Member to 261001 or later, then confirm the version on the plugins screen rather than trusting the update notice.
- Run the update from the plugins screen or with wp plugin update s2member, and check the build number afterwards.
- If you cannot update immediately, disable PayPal IPN handling in the plugin or block POST requests to the notification endpoint at the firewall.
- Review the web server log for POSTs to the plugin's PayPal notification path from addresses that are not PayPal.
- Rotate the PayPal API credentials the site uses, and check the WordPress user list for accounts created around the same time.
What this means for South African businesses
Membership and course sites are exactly the kind of small local business that installs a plugin once, wires it to a payment gateway, and then leaves it alone for years because it still works. A 9.8 flaw in the payment path is worth treating as urgent even when the exploit needs a specific request shape, because the payoff for an attacker on a site holding member records and card-adjacent data is high. My read is that the sites most at risk here are the ones whose plugin updates are paused by a developer who has since moved on.
Source: Wordfence advisory for CVE-2026-86596.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.