s2Member WordPress Plugin Code Injection Flaw Has Public Exploit Code (CVE-2026-86596)

Scope: s2Member WordPress plugin, all versions through 260927, fixed in 261017

Severity: Red

CVE-2026-86596 is a critical code injection vulnerability in s2Member, a widely used WordPress plugin for memberships, content restriction, paywalls, and subscription access. The flaw sits in the plugin’s email template system, where a function called strip_php_tags_deep only strips literal opening PHP tags and fails to properly sanitise the item_name parameter, allowing an attacker to inject code that the plugin then executes. Wordfence disclosed the issue on November 2, 2026, and although no confirmed real-world exploitation has been reported yet and the flaw is not currently on CISA’s exploited catalog, a working proof-of-concept exploit has already been published publicly on GitHub, demonstrating confirmed remote code execution against a lab target. Public PoC code typically closes the gap between disclosure and real exploitation attempts to a matter of hours or days rather than weeks, so the absence of confirmed in-the-wild attacks so far should not be read as low urgency. Given how commonly membership and paywall plugins like s2Member are used across business and institutional WordPress sites, including in Uganda, this is a broadly relevant flaw rather than a niche one. Administrators running s2Member must update to version 261017 or later today, treating this with the same urgency as a confirmed active exploit given the public proof-of-concept code already circulating.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.