# s2Member <= 261011 - Unauthenticated Denial of Service via REST API Collection Requests

- **ID:** WPSEC-2026-1208
- **Plugin:** s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (`s2member`), https://wordpress.org/plugins/s2member/
- **Affected versions:** from 261011 before 261017
- **Fixed in:** 261017 (Update to 261017 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
- **Weakness:** CWE-400
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-18)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/s2member
- **Fix released:** 2026-10-17
- **Published:** 2026-10-18
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1208/

## Description

The s2Member plugin for WordPress is vulnerable to Denial of Service via the REST API collection access filters in versions 261011 up to, and including, 261011. This is due to uncontrolled resource consumption: on every post, term, comment and search collection request, the filters scanned every matching item (all terms, and all posts and comments in batches of 200 with a membership access check on each) to build an exclusion list. This makes it possible for unauthenticated attackers to exhaust server resources by repeatedly requesting public REST collection endpoints on sites that have membership restrictions configured.

## References

- https://wpsec.com/vuln/WPSEC-2026-1208/
- https://plugins.svn.wordpress.org/s2member/tags/261017/
- https://wordpress.org/plugins/s2member/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1208/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.