A critical remote code execution vulnerability in the s2Member WordPress plugin allows unauthenticated attackers to gain full control over the affected server.

This is a code injection flaw (CWE-94) where insufficient sanitization of the first_name parameter allows for the injection of PHP tags. When combined with the exposure of a site-global proxy verification key, unauthenticated attackers can bypass security checks and execute arbitrary code on the underlying server.

A successful exploitation of this vulnerability grants the attacker full control over the WordPress environment, leading to complete data compromise, potential lateral movement within the network, and total system loss. With a CVSS score of 8.8, this vulnerability represents a high-severity risk to business operations, as it can be leveraged to exfiltrate sensitive membership data and disrupt critical payment processing services.

Immediate Action: Since a specific patch version is not currently listed, administrators should immediately disable the s2Member plugin until a security update is released by the vendor.

Proactive Monitoring: Monitor server access logs and database queries for suspicious activity, specifically looking for unauthorized requests to PayPal AJAX endpoints or attempts to execute unexpected PHP code.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block malicious patterns targeting the first_name parameter, though this should be considered a temporary measure until the plugin is updated.

Public Exploit Available: Unknown

This vulnerability presents an unacceptable risk to any organization using the s2Member plugin. Given the potential for unauthenticated remote code execution, it is imperative that administrators take immediate action to disable the plugin until a vendor-supplied patch is verified and applied. Do not rely on perimeter defenses alone to mitigate this flaw.