CVE-2026-1994

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

• CWE-269

• https://plugins.trac.wordpress.org/browser/s2member/tags/260127/src/includes/classes/registrations.inc.php#L74
• https://plugins.trac.wordpress.org/changeset/3461625/s2member#file5
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6c31cf92-26b7-484d-8c93-ce241d655d07?source=cve

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1993The ExactMetrics – Google Analytics Dashboard for WordPress …8.8
• CVE-2026-19930A security flaw has been discovered in Dolibarr up to 23.0.3…6.3
• CVE-2026-19931A flaw in libcurl makes it wrongly reuse an HTTP connection …9.8
• CVE-2026-19932A security flaw has been discovered in DefaultFuction Notice…6.3
• CVE-2026-19933A weakness has been identified in DefaultFuction Customer-Re…6.3
• CVE-2026-19934A vulnerability has been found in itsourcecode Hospital Mana…6.3
• CVE-2026-19941An inapplicable NSEC record may be accepted by a `named` res…5.9
• CVE-2026-19942The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, …8.1
• CVE-2026-19943The Gutenverse – WordPress Blocks, Page Builder & Site Edito…6.4
• CVE-2026-19944The WP Crowdfunding plugin for WordPress is vulnerable to ge…4.9
• CVE-2026-19945The WP Crowdfunding plugin for WordPress is vulnerable to St…6.4
• CVE-2026-19946The Awesome Support plugin for WordPress is vulnerable to Mi…4.3