CVE-2024-12563 is a Local File Inclusion vulnerability (CWE-98) in the s2Member Pro WordPress plugin. It affects all versions up to 250214 and allows authenticated users with contributor-level or higher privileges to manipulate the 'template' attribute to include arbitrary files on the server. This can lead to execution of arbitrary PHP code, enabling attackers to bypass access controls, access sensitive information, or execute malicious code. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows authenticated contributors or higher to execute arbitrary PHP code on the server hosting the s2Member Pro plugin. This can result in full compromise of the affected WordPress site, including bypassing access controls, data disclosure, and potential site takeover. The vulnerability impacts confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to file inclusion attempts. Avoid using vulnerable versions of the s2Member Pro plugin where possible.