{
 "id": "WPSEC-2026-1208",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1208/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1208/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1208/index.md",
 "title": "s2Member <= 261011 - Unauthenticated Denial of Service via REST API Collection Requests",
 "description": "The s2Member plugin for WordPress is vulnerable to Denial of Service via the REST API collection access filters in versions 261011 up to, and including, 261011. This is due to uncontrolled resource consumption: on every post, term, comment and search collection request, the filters scanned every matching item (all terms, and all posts and comments in batches of 200 with a membership access check on each) to build an exclusion list. This makes it possible for unauthenticated attackers to exhaust server resources by repeatedly requesting public REST collection endpoints on sites that have membership restrictions configured.",
 "plugin": {
  "slug": "s2member",
  "name": "s2Member",
  "full_name": "s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions",
  "wordpress_org": "https://wordpress.org/plugins/s2member/",
  "advisories_url": "https://wpsec.com/vuln/plugin/s2member/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/s2member"
 },
 "type": "DOS",
 "cwe": [
  "CWE-400"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "261011",
    "from_inclusive": true,
    "to": "261017",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 261011 before 261017"
  ]
 },
 "introduced_in": "261011",
 "fixed_in": "261017",
 "remediation": "Update to 261017 or later.",
 "fix_released": "2026-10-17T03:00:56+00:00",
 "published": "2026-10-18T03:40:36+00:00",
 "updated": "2026-10-17T08:19:29.267868+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1208/",
  "https://plugins.svn.wordpress.org/s2member/tags/261017/",
  "https://wordpress.org/plugins/s2member/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/s2member",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-18"
 }
}