CVE-2026-1994

The CVE concerns the WordPress s2Member plugin (versions up to 260127). The root cause is that the plugin does not properly validate a user’s identity before updating their password, enabling unauthenticated attackers to change arbitrary user passwords, including administrators, via account takeo...

CVE-2026-1994 s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to...

WordPress plugin s2Member 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...