CVE-2026-19804 clavaque CVE debrief

Who should care

WordPress site administrators and defenders who use the s2Member plugin should assess exposure and apply patches or mitigations to prevent potential Remote Code Execution attacks. This vulnerability allows unauthenticated attackers to execute code on the server if the site administrator has configured a Signup Tracking Codes template with the %%first_name%% placeholder and the attacker has obtained the site-global proxy verification key.

Why it matters

CVE-2026-19804 is a high-severity vulnerability in the s2Member plugin for WordPress that allows unauthenticated attackers to execute code on the server. WordPress site administrators and defenders should assess exposure and apply patches or mitigations to prevent potential Remote Code Execution attacks.

• Remote code execution on the server
• Potential for unauthorized access and modification of sensitive data
• Possible disruption of WordPress site functionality and availability
• Need for verification of patch application and vulnerability remediation

Technical summary

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed.

Defensive priority

High priority for WordPress site administrators and defenders to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if the s2Member plugin is installed and if the Signup Tracking Codes template is configured with the %%first_name%% placeholder.
• Verify if the site-global proxy verification key has been exposed or obtained by potential attackers.
• Apply patches or updates to the s2Member plugin to fix the vulnerability.
• Monitor for suspicious activity or exploitation attempts on the WordPress site.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code. The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.