Security notice

Run s2Member on WordPress? A flaw rated 9.8 can let attackers run code. Update today.

Last updated: Tuesday, November 3, 2026, 8:25 AM ETStatus: Fix released. Public proof of concept. No attacks reported. Update now.

s2Member is a WordPress plugin for memberships, paywalls and members-only content. WordPress.org shows 8,000+ active installations. On November 2, 2026, Wordfence published a critical flaw in it, CVE-2026-86596, which Wordfence rates 9.8 out of 10. It involves text that arrives in PayPal payment notifications, and it can let an attacker run code on your server, which means a stranger running their own commands on it. Wordfence's headline and score say no login is needed, but its own description says a logged-in user is required, so see below. Versions up to and including 260927 are affected. Wordfence lists 261001 as fixed, and WordPress.org currently offers 261017. Uganda's national CERT says a working proof of concept, which is demonstration code, is public. We found no report of attacks, and CISA does not list it as exploited. If your site runs s2Member, update to the newest version today, and then check for PHP files and administrator accounts you did not add.

What happened

The flaw. Wordfence advisory describes "Remote Code Execution" in s2Member, meaning a way to make your server run an attacker's commands. It involves text that arrives in PayPal payment notifications (called IPN), which the plugin does not clean up well enough. We are leaving out the technical details. (Wordfence advisory, CVE record, CERT-UG)
Does it need a login? The sources do not agree. The title of Wordfence's advisory says "Unauthenticated Remote Code Execution," and its 9.8 score is for an attack that needs no account. The description text in the same advisory and in the CVE record says "authenticated attackers, with custom-level access and above," which would mean a logged-in user. We cannot tell which is right, and neither Wordfence nor CERT-UG explains the difference. Until Wordfence clears it up, treat the flaw as needing no login. Updating fixes it either way. (Wordfence advisory, CVE record)
How serious. Wordfence rates it CVSS 9.8, which is 9.8 out of 10 and critical. The NVD entry is marked "Deferred" and shows only Wordfence's score. Running code on your server can give an attacker control of the whole site, including member data. (Wordfence advisory, NVD)
Affected and fixed versions. The CVE record and Wordfence list s2Member 260927 and earlier as affected. Wordfence says to "update to version 261001, or a newer patched version." CERT-UG says the fix is in 261017, and WordPress.org currently offers 261017, last updated October 17, 2026. The WordPress.org changelog does not name this CVE or the specific fix in any version, so we rely on Wordfence for 261001. (Wordfence advisory, CVE record, CERT-UG, WordPress.org)
Why take the newest version. Wordfence also lists a lower-rated s2Member flaw, CVE-2026-109972 (6.4), published October 27, that affects versions up to 261011. Taking 261017 covers both. (Wordfence advisory, WordPress.org)
The dates. Wordfence published the advisory on November 2, 2026, and the CVE record was published the same day, with Wordfence as the assigning authority. WordPress.org shows version 261017 was last updated on October 17, before the advisory, so a site that kept its plugins updated may already be covered. Check the version. (Wordfence advisory, CVE record, WordPress.org)
A public proof of concept exists. CERT-UG says a working proof of concept has been published on GitHub and demonstrates remote code execution against a lab target. GitHub's own records show a public repository for it was created on the evening of November 2. We do not link it or describe it. CERT-UG says public proof of concept code typically shortens the time between disclosure and real attacks to hours or days. That is CERT-UG's view, not a report of attacks. (CERT-UG)
No attacks reported yet. CERT-UG says no real-world exploitation has been confirmed yet, and CISA KEV does not list the flaw in its version dated October 30, 2026, which we checked directly on November 3. We found no report that it is being attacked. That does not mean it has not been: the details and a public demonstration have been out since November 2. (CERT-UG, CISA KEV)
This plugin has had other serious flaws. Wordfence's list for s2Member includes a September 24 flaw, CVE-2026-19804, rated 8.8, that Wordfence describes as unauthenticated remote code execution, and a February 18 flaw, CVE-2026-1994, rated 9.8. This is a reason to keep it updated, and says nothing about the new flaw. (Wordfence advisory)
The paid Pro add-on: not confirmed. The advisory names the plugin on WordPress.org. We found no statement about s2Member Pro. The WordPress.org changelog lists separate Framework and Pro entries, so if you use Pro, check it is up to date as well. (Wordfence advisory, WordPress.org)
Whether PayPal has to be set up: not stated. The sources do not say what settings a site needs for the flaw to apply, so do not rely on not using PayPal. (Wordfence advisory, CERT-UG)

Who should worry

This is about WordPress websites that use the s2Member plugin for memberships, paywalls, members-only content or subscription access. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:

Your WordPress site uses s2Member and is on version 260927 or earlier, or you do not know the version.
You charge for access to content, run a members area or sell subscriptions on WordPress.
Automatic plugin updates are off on your site, or you are not sure they are on.
An agency or developer built your membership pages and you do not know which plugin runs them.
You run a web agency or host and look after WordPress sites for clients.

If your site does not use s2Member, this notice does not apply to you.

What to do now

Do these today.

Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "s2Member" by Cristian Lavaque. Note the version number. Wordfence says 261001 or newer has the fix, and 261017 is the newest we saw.
Update. Update the plugin to the newest version, which is 261017 at the time of writing, and at the very least 261001. Take a backup first. WordPress.org lists WordPress 4.2 and PHP 5.6.2 as the minimums for 261017. If you also use s2Member Pro, update it too. (Wordfence advisory, WordPress.org)
If you cannot update today, ask your developer or host what to do before you deactivate it. That is a general precaution, not the plugin maker's advice, and switching off a membership plugin can stop payments and sign-ups and may make members-only pages visible to everyone. We found no other workaround in the sources.
Check for a break-in. No confirmed attacks have been reported, so there is nothing specific to look for. As a general check, especially if you were on 260927 or earlier since November 2, ask your developer or host to look for PHP files you did not add, in wp-content/uploads and in the plugin folders, for administrator accounts you do not recognize, and for plugins you did not install, and to check server logs for unusual requests. If you find anything, treat the site as compromised: restore from a known-good backup, then change the WordPress admin and database passwords and the WordPress salts. This is general advice, not from the sources above.
Check your site afterwards. Sign in as a member, open a protected page and make a test sign-up or payment if you can, to confirm they still work.

What to send your developer, agency or host

s2Member 260927 and earlier has a critical remote code execution flaw, CVE-2026-86596 (CVSS 9.8, assigned by Wordfence, published November 2, 2026). Wordfence lists 261001 as the first fixed version, and 261017 is the newest on WordPress.org. Uganda's national CERT says a public proof of concept exists. CISA does not list it as exploited and we found no report of attacks. Please tell us whether our site runs s2Member or s2Member Pro and which version. If it is 260927 or earlier, please back up, then update to the newest version today, check wp-content/uploads and the plugin folders for PHP files nobody added, and look for new administrator accounts. If anything looks wrong, please treat the site as compromised, restore a known-good backup and change the admin and database passwords and the WordPress salts, and tell us what you find. Sources: the Wordfence advisory, the CVE record, CERT-UG, WordPress.org.

Common questions

Has my site been hacked?

This notice does not mean your site has been hacked. It means a critical flaw has been published, a fix is out and a public proof of concept exists. We found no report of attacks.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs or which versions they are on, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

Which version do I need?

Wordfence says 261001 or newer. The newest on WordPress.org is 261017, and CERT-UG names 261017. Take the newest. (Wordfence advisory, CERT-UG, WordPress.org)

Is it being exploited?

We found no report that it is, and CISA does not list it. A public proof of concept has been out since November 2, so do not wait. (CISA KEV, CERT-UG)

Where can I follow official updates?

The WordPress.org changelog and the Wordfence advisory. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Wordfence: s2Member <= 260927: Unauthenticated Remote Code Execution via 'item_name' IPN Parameter, published November 2, 2026, checked November 3, 2026
CVE Program: CVE-2026-86596, published November 2, 2026 by Wordfence, checked November 3, 2026
NVD: CVE-2026-86596, status Deferred, checked November 3, 2026
CERT-UG (Uganda National CERT): s2Member WordPress Plugin Code Injection Flaw Has Public Exploit Code (CVE-2026-86596), November 3, 2026, checked November 3, 2026
WordPress.org: s2Member plugin page and changelog, version 261017, checked November 3, 2026
CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 30, 2026, checked November 3, 2026