CVE-2026-86802 - To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

Back Back to CVE browser

LOW

To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

Published Sep 21, 2026

3.7

LOW

CVSS 3.1

EPSS 0.25%

Description

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.

Affected products

Vendor n/a Product To Do List Member Default
unknown
Affected
- ≥ 1.4, ≤ 1.6

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	To Do List Member	unknown	Affected ≥ 1.4, ≤ 1.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83869
Advisory
https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-83869		Advisory
https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 21, 2026

Updated Sep 21, 2026

Reserved Sep 8, 2026

Link CVE-2026-86802

CISA Vulnrichment

Updated Sep 21, 2026

NVD

Status Deferred

Modified Sep 21, 2026

Link CVE-2026-86802

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Sep 21, 2026

Updated Sep 21, 2026

Link EUVD-2026-83869

GitHub

No data