WordPress s2Member Plugin Remote Code Execution Vulnerability

The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 260927. The flaw is triggered via the item_name parameter.

The issue stems from insufficient sanitization in strip_php_tags_deep(), which only strips literal '

• Affected versions: all versions up to and including 260927
• Attackers: authenticated attackers with custom-level access and above
• Impact: arbitrary code execution on the server