# s2Member <= 261001 - Unauthenticated Missing Authorization to Protected Content via REST API

- **ID:** WPSEC-2026-0924
- **Plugin:** s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (`s2member`), https://wordpress.org/plugins/s2member/
- **Affected versions:** all versions before 261011
- **Fixed in:** 261011 (Update to 261011 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/s2member
- **Fix released:** 2026-10-11
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0924/

## Description

The s2Member plugin for WordPress is vulnerable to unauthorized access of restricted content via the REST API in all versions up to, and including, 261001. This is due to the REST security gate identifying the resource only from the route's type and ID segments, so it never checked comments, and it did not check single items of post types whose REST base differs from the post type name. This makes it possible for unauthenticated attackers to read comments on membership-restricted posts and pages, and restricted custom post type content, that should be available only to members with the required access level.

## References

- https://wpsec.com/vuln/WPSEC-2026-0924/
- https://plugins.svn.wordpress.org/s2member/tags/261011/
- https://wordpress.org/plugins/s2member/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0924/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.