CVE-2026-86802

To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.

Affected

To Do List Member

CVSS v3.1 WPSCAN

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.25% chance of exploitation in the next 30 days, 15th percentile

Published

2026-09-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/

References

• CVE Record
• NVD entry