s2Member <= 260814 - Unauthenticated Remote Code Execution via 'first_name' Parameter in PayPal Proxy Return

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-19804 · Microsoft / collected KEV context

cve-program · CVE-2026-19804

• https://www.wordfence.com/threat-intel/vulnerabilities/id/e87da8fa-04cc-4b9a-9dde-be7d4f2bd76e?source=cve
• https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/utilities.inc.php#L49
• https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/tracking-codes.inc.php#L71
• https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L311
• https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in-subscr-or-wa-w-level.inc.php#L319
• https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L92
• https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-utilities.inc.php#L185
• https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-checkout-in.inc.php#L736
• https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/paypal-return-in.inc.php#L47
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3671073%40s2member&new=3671073%40s2member

No related operational record is retained in the current change model.