s2Member Pro PHP Object Injection Vulnerability

A PHP Object Injection vulnerability has been identified in the s2Member Pro plugin for WordPress, affecting all versions through 241216. The vulnerability arises from the deserialization of untrusted input in the 's2member_pro_remote_op' parameter, allowing unauthenticated attackers to inject PHP objects. While the vulnerable software does not have a known payload execution chain, the presence of such a chain through an additional plugin or theme could enable an attacker to delete arbitrary files, access sensitive data, or execute code.

Impact

Exploitation of this vulnerability could lead to unauthorized PHP object injection, with the potential for object manipulation if a suitable payload execution chain is available.

Remediation

Users are advised to update to s2Member Pro version 250214 or later.