CVE-2026-86596

The s2Member plugin for WordPress (versions <= 260927 ) is vulnerable to Remote Code Execution (RCE) via the 'item_name' IPN parameter. The flaw stems from insufficient sanitization in the strip_php_tags_deep() function, which only removes literal <? sequences. This, combined with a post-in...