CVE-2026-86596: RCE in s2Member WordPress Plugin

CVE-2026-86596 affects the s2Member plugin for WordPress, one of the most widely deployed access management systems. The Remote Code Execution vulnerability lies in the strip_php_tags_deep() function, which insufficiently sanitizes the 'item_name' parameter. The design flaw is that the function removes only literal '<?' sequences but fails to prevent post-interpolation placeholder cleanup from reassembling a valid '<?php' opener, allowing an attacker to inject PHP code that is then executed by the server.

Severity is declared critical with CVSS 9.8. The CVE was published on NVD on November 2, 2026, the same day a public proof-of-concept appeared on GitHub (described as lab implementation with IPN verification required). The official description specifies that all authenticated users with custom-level access and above are vulnerable, indicating the flaw requires internal credentials. The combination of RCE and server-level execution makes this a critical threat to any unpatched installation of this widely deployed plugin.

IT teams and system administrators must act with urgency: immediately verify which s2Member installations are in production, consult the official changelog to identify available patches, and review access logs and email template modifications for signs of exploit. In the meantime, restrict plugin access to trusted administrators only and closely monitor template file changes. Absent an official patch, consider isolating or temporarily disabling the plugin until a security update becomes available.