WordPress s2Member Plugin Remote Code Execution via First Name

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The s2Member WordPress plugin contains a critical remote code execution vulnerability affecting all versions up to 260814. The flaw stems from insufficient sanitization of the 'first_name' parameter, which uses esc_refs() to strip only regex backreferences while leaving PHP tags intact. When this unsanitized input is substituted into eval'd Signup Tracking Codes templates, attackers can inject arbitrary PHP code and achieve remote code execution. This vulnerability impacts any WordPress installation using s2Member for membership management, content restriction, paywalls, and subscription handling—making it a high-risk threat for membership-based websites, SaaS platforms, and content publishers relying on this plugin for access control.

Casky's 323 mapped security skills leverage Claude AI with extended reasoning to identify attack chains across MITRE ATT&ACK Initial Access (TA0001) and Resource Development (TA0043) techniques. Practitioners using Casky would detect suspicious patterns including: (1) POST requests to WordPress user registration endpoints with malicious PHP tags embedded in first_name parameters; (2) eval() function execution chains triggered by template substitution; (3) unexpected PHP code objects instantiated during membership signup flows; and (4) reconnaissance activities mapping the plugin version and signup form structure. The platform's skill-mapped detection would surface these indicators as part of a coordinated attack pattern, helping security teams correlate code injection attempts with subsequent command execution and persistence mechanisms before exploitation succeeds.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-19804.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-19804

Casky has 323 skills that investigate the attack patterns behind CVE-2026-19804. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn