A critical code injection vulnerability in the s2Member plugin could allow an unauthenticated attacker to execute arbitrary commands, resulting in full site compromise.

The vulnerability is categorized as Improper Control of Generation of Code, enabling an unauthenticated attacker to inject malicious code into the application environment.

A CVSS score of 9.8 highlights the extreme risk associated with this flaw. Successful exploitation permits an attacker to bypass security controls entirely, potentially leading to unauthorized data exfiltration, the installation of backdoors, or complete system takeover, which would cause significant reputational and operational damage.

Immediate Action: Update the s2Member plugin to a patched version beyond 250905 immediately.

Proactive Monitoring: Monitor system logs for unauthorized file modifications or suspicious code execution patterns within the WordPress installation directory.

Compensating Controls: Utilize a WAF to filter malicious input and restrict access to administrative or sensitive plugin endpoints that may be targeted during exploitation.

Public Exploit Available: Not specified

This vulnerability is critical and requires immediate attention. Organizations should verify their current version of s2Member and apply the necessary security updates to prevent remote code injection and potential full-system compromise.