s2Member <= 261011 - Unauthenticated Denial of Service via REST API Collection Requests
- ID
- WPSEC-2026-1208
- Plugin
- s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (s2member)
- Affected
- from 261011 before 261017
- Remediation
- Update to 261017 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Weakness
- CWE-400
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-17
- Attack surface
- s2Member on WPSec AttackSurface
- Fix released
- Published
Description
The s2Member plugin for WordPress is vulnerable to Denial of Service via the REST API collection access filters in versions 261011 up to, and including, 261011. This is due to uncontrolled resource consumption: on every post, term, comment and search collection request, the filters scanned every matching item (all terms, and all posts and comments in batches of 200 with a membership access check on each) to build an exclusion list. This makes it possible for unauthenticated attackers to exhaust server resources by repeatedly requesting public REST collection endpoints on sites that have membership restrictions configured.
References
- https://wpsec.com/vuln/WPSEC-2026-1208/
- https://plugins.svn.wordpress.org/s2member/tags/261017/
- https://wordpress.org/plugins/s2member/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS