WordPress s2Member Plugin Relative Path Traversal Vulnerability Allowing Local File Inclusion

A relative path traversal vulnerability has been identified in the WordPress s2Member plugin, specifically in versions through 250214. This vulnerability allows for local file inclusion, which could enable a malicious actor to access and display local files from the target website, potentially leading to a database takeover if sensitive information such as database credentials is exposed.

Impact

Exploitation of this vulnerability could allow for local file inclusion, enabling the inclusion of local files on the server and displaying their contents. This could be particularly harmful if files containing sensitive information, like database credentials, are accessed, as it could lead to a complete takeover of the database, depending on the configuration.

Remediation

Users of the WordPress s2Member plugin should update to version 250424 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.