CVE-2025-62023 describes a code injection vulnerability in the s2Member plugin by Cristián Lávaque, affecting all versions up to 250905. The flaw involves improper control of code generation, which can lead to arbitrary code execution. The vulnerability has a CVSS v3.1 score of 9.0, indicating critical severity with network attack vector, high attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No official patch or vendor advisory has been provided yet, and no exploits are currently known in the wild. The vulnerability is not related to a cloud service, so remediation depends on the vendor releasing a fix.

If exploited, this vulnerability could allow an unauthenticated attacker to execute arbitrary code remotely, leading to full compromise of the affected system's confidentiality, integrity, and availability. Given the critical CVSS score and the nature of code injection, the impact is severe, potentially allowing complete control over the affected s2Member installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting exposure of the affected s2Member plugin to untrusted networks. Monitor vendor channels for updates and apply patches promptly once available.