Back to the CVE list
CVE-2025-62023

WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability

CVSS score

9.0

EPSS probability

%0.4

Risk score

0.0

Published

1 y ago

OverviewPublic Exploits (1)NewsroomVulnerability Timeline

Public Exploits · GitHub and Metasploit Intelligence

This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.

G
josemour8/CVE-2025-62023
GitHub

s2Member (WordPress) Unauth RCE via SP Tracking Codes eval() + BONUS: incomplete-fix bypass — IPN notify vector still open in 251005..2512xx (fixed only in 260101, strip_php_tags_deep added to notify handler //251226).

Public PoCSource updated: 29.09.2026 10:19:48

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-62023"