CVE-2026-19804

HIGH
Published Sep 25, 2026 Modified Sep 25, 2026 CWE-94

Description

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.

Is your site exposed to CVE-2026-19804?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0104
Probability of exploitation
0.63%
Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-94 CWE-94

References

Other References

https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-checkout-in.inc.php#L736 https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L311 https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L319 https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in.inc.php#L47 https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L185 https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L92 https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/tracking-codes.inc.php#L71 https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/utilities.inc.php#L49 https://plugins.trac.wordpress.org/changeset?reponame=&old=3671073%40s2member&new=3671073%40s2member https://www.wordfence.com/threat-intel/vulnerabilities/id/e87da8fa-04cc-4b9a-9dde-be7d4f2bd76e?source=cve

Frequently Asked Questions

What is CVE-2026-19804? +
The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site. It has a CVSS v3.1 base score of 8.8 (HIGH).
How severe is CVE-2026-19804? +
CVE-2026-19804 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0104, placing it in the 1th percentile for exploitation probability.
How do I check if I'm vulnerable to CVE-2026-19804? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-22136

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk Electron Fuses, including …
CVE-2025-24482

A Local Code Injection Vulnerability exists in the product and version listed above. The vulnerability is due to incorrect default …
CVE-2026-72717

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression …
CVE-2026-77077

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers …
CVE-2026-59859

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, …
CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2026-19804 — free, no signup required.