s2Member <= 261001 - Unauthenticated Missing Authorization to Protected Content via REST API
- ID
- WPSEC-2026-0924
- Plugin
- s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (s2member)
- Affected
- all versions before 261011
- Remediation
- Update to 261011 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-14
- Attack surface
- s2Member on WPSec AttackSurface
- Fix released
- Published
Description
The s2Member plugin for WordPress is vulnerable to unauthorized access of restricted content via the REST API in all versions up to, and including, 261001. This is due to the REST security gate identifying the resource only from the route's type and ID segments, so it never checked comments, and it did not check single items of post types whose REST base differs from the post type name. This makes it possible for unauthenticated attackers to read comments on membership-restricted posts and pages, and restricted custom post type content, that should be available only to members with the required access level.
References
- https://wpsec.com/vuln/WPSEC-2026-0924/
- https://plugins.svn.wordpress.org/s2member/tags/261011/
- https://wordpress.org/plugins/s2member/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS