Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2024-12562: s2Member Pro plugin for WordPress: Unauthenticated Code Execution
CVE-2024-12562 · published 1 year ago
Summary
The s2Member Pro plugin for WordPress is vulnerable to a security flaw that could allow hackers to execute code on your website without needing a password. This could lead to data theft, file deletion, or other malicious activities. Update to the latest version of the plugin as soon as possible to protect your website.
What to do
- Update s2member s2member to version 250214 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| s2member | s2member |
< 250214 cpe:2.3:a:s2member:s2member:*:*:*:*:pro:wordpress:*:* |
Original advisory text
The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op' vul...
The s2Member Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 241216 via deserialization of untrusted input from the 's2member_pro_remote_op' vulnerable parameter. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References
- https://s2member.com/changelog/ Release Notes
- https://www.wordfence.com/threat-intel/vulnerabilities/id/65192fdb-86db-475a-8c6... Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published15 Feb 2025
Updated3 Nov 2026
First seen7 Mar 2026
Sources
CVE-2024-12562 · NVD
Track software like this
Free during beta