CVE-2026-1994CWE-269

s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover

Critical · published February 19, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
36.0
In the wild
Unconfirmed
What it is

The s2Member plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 260127. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00428 · 36.0th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-02-19T06:49Z
EPSS history
Timeline
  • 19 FEB 06:49Z
    s2Member <= 260127 - Unauthenticated Privilege Escalation via Account Takeover
    cvelistv5