CVE-2026-1994

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1994", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-05T16:34:36.592Z", "datePublished": "2026-02-19T06:49:43.503Z", "dateUpdated": "2026-04-08T16:59:09.633Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:09.633Z"}, "affected": [{"vendor": "clavaque", "product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "260127", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account."}], "title": "s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31cf92-26b7-484d-8c93-ce241d655d07?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/s2member/tags/260127/src/includes/classes/registrations.inc.php#L74"}, {"url": "https://plugins.trac.wordpress.org/changeset/3461625/s2member#file5"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management", "cweId": "CWE-269", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Alyudin Nafiie"}], "timeline": [{"time": "2026-02-18T18:11:15.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T21:20:12.391999Z", "id": "CVE-2026-1994", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:20:40.661Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1994", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-19T21:20:12.391999Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T21:20:28.775Z"}}], "cna": {"title": "s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover", "credits": [{"lang": "en", "type": "finder", "value": "Alyudin Nafiie"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "clavaque", "product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "260127"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T18:11:15.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31cf92-26b7-484d-8c93-ce241d655d07?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/s2member/tags/260127/src/includes/classes/registrations.inc.php#L74"}, {"url": "https://plugins.trac.wordpress.org/changeset/3461625/s2member#file5"}], "descriptions": [{"lang": "en", "value": "The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-02-19T06:49:43.503Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1994", "state": "PUBLISHED", "dateUpdated": "2026-02-19T21:20:40.661Z", "dateReserved": "2026-02-05T16:34:36.592Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-19T06:49:43.503Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions", "vendor": "clavaque", "versions": [{"lessThanOrEqual": "260127", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account."}, {"lang": "es", "value": "El plugin s2Member para WordPress es vulnerable a escalada de privilegios mediante toma de control de cuenta en todas las versiones hasta la 260127, inclusive. Esto se debe a que el plugin no valida correctamente la identidad de un usuario antes de actualizar su contrase\u00f1a. Esto hace posible que atacantes no autenticados cambien las contrase\u00f1as de usuarios arbitrarios, incluidos los administradores, y aprovechen eso para obtener acceso a su cuenta."}], "id": "CVE-2026-1994", "lastModified": "2026-06-17T10:16:50.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1994", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T21:20:12.391999Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:44.403", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/s2member/tags/260127/src/includes/classes/registrations.inc.php#L74"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3461625/s2member#file5"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31cf92-26b7-484d-8c93-ce241d655d07?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-269"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,260127]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "s2Member \u2013 Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions", "source": "cna", "vendor": "clavaque"}, "product": "s2member_\u2013_excellent_for_all_kinds_of_memberships,_content_restriction_paywalls_&_member_access_subscriptions", "vendor": "clavaque"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T20:17:09.029566+00:00", "value": {"mitigation_remediation": ["Upgrade the s2Member plugin to version 260128 or later, which implements proper user identity verification before password changes.", "If an upgrade cannot be performed immediately, temporarily disable the plugin or block the password\u2011change endpoint using a firewall rule or .htaccess configuration to prevent unauthenticated access.", "Configure a web application firewall or security plugin to reject unauthenticated password\u2011change requests and monitor logs for suspicious activity."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via Unauthenticated Account Takeover"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the clavaque s2Member plugin with a version of 260127 or earlier are affected. The plugin is commonly installed to enforce membership, content restrictions, and subscription access controls.", "description_and_impact": "The s2Member plugin for WordPress can be exploited by any unauthenticated user to change the passwords of any account, including administrators, because the plugin fails to confirm the current user's identity before processing a password change. This flaw, identified as CWE\u2011269, allows an attacker to assume the privileges of the targeted account and thereby access or modify site content, user data, or all the site\u2019s administrative functions. The vulnerability is present in all versions up to and including 260127.", "risk_and_exploitability": "The CVSS score of 9.8 classifies this issue as critical, but the EPSS score of less than 1% reflects a low current exploitation probability. This vulnerability is not listed in CISA\u2019s KEV catalog. An attacker can trigger the flaw by sending unauthenticated HTTP requests to the plugin\u2019s password\u2011update endpoint, after which the attacker gains full control over the target account and potentially the entire WordPress installation."}}}}, "created": "2026-02-19T10:21:13.776176+00:00", "updated": "2026-04-15T20:30:13.766244+00:00", "vendors": ["clavaque", "clavaque$PRODUCT$s2member_\u2013_excellent_for_all_kinds_of_memberships,_content_restriction_paywalls_&_member_access_subscriptions", "wordpress", "wordpress$PRODUCT$wordpress"]}