CVE-2025-58998

Name of the Vulnerable Software and Affected Versions s2Member versions prior to 250702

Description The s2Member plugin for WordPress contains a flaw allowing PHP Object Injection through the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object. While no native POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update s2Member to a version newer than 250701.