The s2Member plugin for WordPress can be exploited by any unauthenticated user to change the passwords of any account, including administrators, because the plugin fails to confirm the current user's identity before processing a password change. This flaw, identified as CWE‑269, allows an attacker to assume the privileges of the targeted account and thereby access or modify site content, user data, or all the site’s administrative functions. The vulnerability is present in all versions up to and including 260127.

WordPress sites that use the clavaque s2Member plugin with a version of 260127 or earlier are affected. The plugin is commonly installed to enforce membership, content restrictions, and subscription access controls.

The CVSS score of 9.8 classifies this issue as critical, but the EPSS score of less than 1% reflects a low current exploitation probability. This vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the flaw by sending unauthenticated HTTP requests to the plugin’s password‑update endpoint, after which the attacker gains full control over the target account and potentially the entire WordPress installation.