The vulnerability in the s2Member plugin for WordPress allows the execution of arbitrary PHP code by passing a specially crafted string in the 'item_name' field received from PayPal IPN calls. The defect arises because the strip_php_tags_deep() function only removes literal '<?' sequences, while a later placeholder cleanup step reassembles a valid '<?php' opener from the attacker-controlled value after it has already been embedded into an email template. Consequently, an attacker can inject PHP code that will be treated as executable server code, leading to full compromise of the application’s server environment. The weakness is a classic injection flaw catalogued as CWE-94.

This flaw affects all installed versions of the s2Member plugin up to and including build 260927. The plugin is distributed under the name "clavaque:s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions" and is typically used on WordPress sites to manage subscriptions and content access. No version retirement or patch is mentioned in the available data, so all installations of any 260927 or earlier build remain vulnerable.

The CVSS score of 9.8 classifies it as Critical, and the EPSS score is not available, indicating the chance of exploitation has not been quantified but a high-CVSS vulnerability is generally considered likely to be targeted. The vulnerability is not listed in the CISA KEV catalog as of this analysis. The exploitation requires the attacker to submit an IPN POST with a crafted 'item_name' value; the description states that the attacker must have custom-level access or higher, implying that privileged accounts are needed to capitalize on the flaw. Because the IPN request originates from PayPal, an attacker would need to either compromise the PayPal account or use an authenticated session that can trigger the IPN process. The resulting code execution offers complete control over the compromised WordPress installation, including file modifications, database access, and lateral movement. The high CVSS score coupled with the necessity of authenticated access renders the risk significant for sites using vulnerable plugin versions.