WordPress Plugin Vulnerabilities
s2Member < 251005 - Unauthenticated Remote Code Execution
Description
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 250905. This makes it possible for unauthenticated attackers to execute code on the server.
Affects Plugins
Fixed in 251005 References
Classification
Type
RCE
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Drew Webber (mcdruid)
Verified
No
WPVDB ID
Timeline
Publicly Published
2025-10-01 (about 7 months ago)
Added
2025-10-29 (about 6 months ago)
Last Updated
2025-10-29 (about 6 months ago)
WPScan 