CVE-2026-86596

Name of the Vulnerable Software and Affected Versions s2Member versions prior to 260928

Description Authenticated attackers with custom-level access and above can achieve remote code execution on the server. The issue exists in the IPN email template handling due to insufficient sanitization in the strip php tags deep() function, which only removes literal '<?' sequences. A post-interpolation placeholder cleanup process subsequently reassembles a valid '<?php' opener after the attacker-controlled value is embedded in the email template. This allows the injection of PHP code via the item name parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.