CVE-2026-86802

LOW 3.7

To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.

Vendor	unknown
Product	to do list member
Published	Sep 21, 2026

Stay Ahead of the Next One

Get instant alerts for unknown to do list member

Be the first to know when new low vulnerabilities affecting unknown to do list member are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Unknown / To Do List Member

1.4 ≤ 1.6

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/

Credits

Pablo González Pérez Francisco José Ramírez Vicente Iñigo Sánchez Enciso WPScan