CVE-2026-19804 (GCVE-0-2026-19804)
Vulnerability from cvelistv5
Published
2026-09-25 07:40
Modified
2026-09-25 13:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Summary
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| clavaque | s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions |
Version: 0 ≤ 260814 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19804",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-25T12:49:31.243312Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T13:00:13.907Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls \u0026 Member Access Subscriptions",
"vendor": "clavaque",
"versions": [
{
"lessThanOrEqual": "260814",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Supakiad S. (m3ez)"
}
],
"descriptions": [
{
"lang": "en",
"value": "The s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls \u0026 Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the \u0027first_name\u0027 parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval\u0027d Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-25T07:40:30.062Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e87da8fa-04cc-4b9a-9dde-be7d4f2bd76e?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/utilities.inc.php#L49"
},
{
"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/tracking-codes.inc.php#L71"
},
{
"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L311"
},
{
"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L319"
},
{
"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L92"
},
{
"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L185"
},
{
"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-checkout-in.inc.php#L736"
},
{
"url": "https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in.inc.php#L47"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3671073%40s2member\u0026new=3671073%40s2member"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-09-24T18:56:33.000Z",
"value": "Disclosed"
}
],
"title": "s2Member \u003c= 260814 - Unauthenticated Remote Code Execution via \u0027first_name\u0027 Parameter in PayPal Proxy Return"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-19804",
"datePublished": "2026-09-25T07:40:30.062Z",
"dateReserved": "2026-08-13T20:36:37.942Z",
"dateUpdated": "2026-09-25T13:00:13.907Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-19804\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-25T12:49:31.243312Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-25T12:55:44.073Z\"}}], \"cna\": {\"title\": \"s2Member \u003c= 260814 - Unauthenticated Remote Code Execution via \u0027first_name\u0027 Parameter in PayPal Proxy Return\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Supakiad S. (m3ez)\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"clavaque\", \"product\": \"s2Member \\u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls \u0026 Member Access Subscriptions\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"260814\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-09-24T18:56:33.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/e87da8fa-04cc-4b9a-9dde-be7d4f2bd76e?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/utilities.inc.php#L49\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/tracking-codes.inc.php#L71\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L311\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L319\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L92\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L185\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-checkout-in.inc.php#L736\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in.inc.php#L47\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3671073%40s2member\u0026new=3671073%40s2member\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The s2Member \\u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls \u0026 Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the \u0027first_name\u0027 parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval\u0027d Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-94\", \"description\": \"CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-09-25T07:40:30.062Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-19804\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-25T13:00:13.907Z\", \"dateReserved\": \"2026-08-13T20:36:37.942Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-09-25T07:40:30.062Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…