s2Member Pro Local File Inclusion Vulnerability Allowing Remote Code Execution

A local file inclusion vulnerability has been identified in the s2Member Pro plugin for WordPress, affecting all versions through 250214. The vulnerability arises from the 'template' attribute, allowing authenticated attackers with contributor-level or higher permissions to include and execute arbitrary files on the server. This exploitation could bypass access controls, access sensitive data, or execute malicious code.

Impact

Exploitation of this vulnerability could lead to unauthorized file inclusion, allowing attackers to execute arbitrary PHP code on the server. This could be used to bypass access controls, access sensitive information, or execute malicious actions under the context of the affected user.

Remediation

Users are advised to update to version 250419 or a newer patched version.