The vulnerability in the s2Member WordPress plugin allows unauthenticated attackers to execute arbitrary PHP code on the web server. It arises from the lack of proper sanitization of the 'first_name' parameter in the PayPal proxy return handling. The plugin uses the esc_refs() function, which only removes regular expression backreferences but leaves PHP tags intact, before passing the value into an eval‑based signup tracking code template. By injecting PHP code into the first_name field and exploiting the placeholder system, an attacker can trigger eval and run code without authentication.

All versions of the s2Member plugin provided by clavaque up to and including 260814 are affected. This plugin is a membership and pay‑wall solution for WordPress sites, and the vulnerability is present in every release within that range that has a signup tracking codes template configured with the %%first_name%% placeholder.

The flaw carries a CVSS score of 8.8, indicating high severity. The EPSS score is 1% and the issue is not listed in the CISA KEV catalog, but the attack surface is wide because the site-global proxy verification key is exposed in plaintext within the JSON response of any PayPal Checkout AJAX request. This key exposure enables an attacker to bypass PayPal’s postback verification and reach the vulnerable code path without needing site credentials. The attack vector is purely remote, triggered via crafted HTTP requests to the plugin’s PayPal proxy return endpoints, and it requires only knowledge of the site’s proxy key and a configured tracking code template containing the placeholder.