CVE-2026-1994 s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to...

CVE-2026-1994

Summary (CVE-2026-1994): The WordPress plugin s2Member is affected by a critical (CVSS 3.1: 9.8) unauthenticated privilege-escalation via account takeover vulnerability affecting versions up to 260127. Root cause: the plugin fails to properly validate a user’s identity before updating a password,...

WordPress plugin s2Member 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...