WordPress plugin security: s2Member RCE fix and 5 more

The s2Member membership plugin has a hole in version 260927 and older that lets a visitor run code on the website's server without logging in. Patchstack rates it 10 out of 10 and marks it as known to be exploited. The fix is in 261001. Five more plugins, including two used by many WooCommerce shops, released fixes between 31 October and 2 November. Update them today.

Which s2Member versions are affected?

Every version up to and including 260927. Version 261001 fixes it, and the current version on WordPress.org is 261017. s2Member is used on membership and paywall sites, so if your site sells member access, check it first. If you cannot update today, turn the plugin off until you can, and ask your developer to check the site for files it does not recognise.

Which other plugins should I update?

For PayHere, Patchstack listed no official fix when it published the entry on 2 November. WordPress.org shows version 2.4.6 released on 30 October. If you use PayHere, update to 2.4.6 and match recent paid orders against your PayHere account, or ask the plugin maker to confirm the fix.

What to do

1. Log in to WordPress and open Plugins > Installed Plugins.
2. If s2Member is listed, take a backup and update it to 261017 now.
3. Check the table and update any of those plugins, one at a time.
4. After updating a shop plugin, place a test order and open one PDF invoice to make sure both still work.
5. Delete plugins you no longer use instead of leaving them switched off.

How SyncTech can help

If an outside developer looks after your site, send them this post today. Backups before every plugin update are part of our WordPress maintenance and security care. Shop owners can also read our new monthly ecommerce maintenance checklist.

Source and credit

We are sharing this news from Patchstack and the plugin makers. This summary is written by Synctech in our own words.

• s2Member 260927 and older unauthenticated remote code execution, Patchstack, 2 November 2026: https://patchstack.com/database/wordpress/plugin/s2member/vulnerability/wordpress-s2member-excellent-for-all-kinds-of-memberships-content-restriction-paywalls-member-access-subscriptions-plugin-260927-unauthenticated-remote-code-execution-vulnerability
• s2Member, WordPress.org: https://wordpress.org/plugins/s2member/#developers
• WP Directory Kit 1.6.0 and older SQL injection, Patchstack, 31 October 2026: https://patchstack.com/database/wordpress/plugin/wpdirectorykit/vulnerability/wordpress-wp-directory-kit-plugin-1-6-0-unauthenticated-sql-injection-vulnerability
• Ultra Addons for Contact Form 7 3.5.54 and older file deletion, Patchstack, 2 November 2026: https://patchstack.com/database/wordpress/plugin/ultimate-addons-for-contact-form-7/vulnerability/wordpress-ultra-addons-for-contact-form-7-plugin-3-5-54-unauthenticated-php-object-injection-to-arbitrary-file-deletion-vulnerability
• PDF Invoices and Packing Slips for WooCommerce 5.16.2 to 5.16.4 stored cross-site scripting, Patchstack, 31 October 2026: https://patchstack.com/database/wordpress/plugin/woocommerce-pdf-invoices-packing-slips/vulnerability/wordpress-pdf-invoices-packing-slips-for-woocommerce-plugin-5-16-2-5-16-4-unauthenticated-stored-xss-vulnerability
• NextGEN Gallery 4.4.1 and older remote code execution, Patchstack, 31 October 2026: https://patchstack.com/database/wordpress/plugin/nextgen-gallery/vulnerability/wordpress-photo-gallery-sliders-proofing-and-themes-nextgen-gallery-plugin-4-4-1-authenticated-custom-remote-code-execution-vulnerability
• PayHere Payment Gateway 2.4.0 to 2.4.5 payment bypass, Patchstack, 2 November 2026: https://patchstack.com/database/wordpress/plugin/payhere-payment-gateway/vulnerability/wordpress-payhere-payment-gateway-plugin-2-4-0-2-4-5-unauthenticated-payment-bypass-vulnerability
• PayHere Payment Gateway, WordPress.org: https://wordpress.org/plugins/payhere-payment-gateway/#developers Retrieved 3 November 2026. WordPress, WooCommerce and the plugin names above are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.