CVE-2026-19804 is a remote code execution vulnerability in the s2Member WordPress plugin (versions up to and including 260814). The vulnerability arises from improper sanitization of the 'first_name' parameter via esc_refs(), which fails to remove PHP tags before the parameter is substituted into an eval'd Signup Tracking Codes template. This allows unauthenticated attackers to execute arbitrary PHP code on the server. The attack is facilitated by the disclosure of the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request, allowing bypass of PayPal postback verification. Successful exploitation requires the site to have a Signup Tracking Codes template configured with the %%first_name%% placeholder and the attacker to obtain the exposed verification key.

An unauthenticated attacker can execute arbitrary code on the server hosting the vulnerable s2Member plugin, potentially leading to full compromise of the affected WordPress site. Confidentiality, integrity, and availability of the site are severely impacted due to remote code execution. The exposure of the proxy verification key also undermines PayPal postback verification, increasing the risk of fraudulent transactions or unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider removing or disabling the Signup Tracking Codes template containing the %%first_name%% placeholder to prevent exploitation. Additionally, monitoring and restricting access to PayPal Checkout AJAX endpoints may reduce exposure of the proxy verification key. Follow vendor advisories closely for official patches or updates.