Security Alert Summary
The To Do List Member WordPress plugin contains an issue in an import routine that lacks authorization and nonce checks and does not validate the remote location used to fetch import data. This allows unauthenticated users to create arbitrary published posts and taxonomy terms on the site.
CVE Details
- CVE ID: CVE-2026-86802
- Affected component: To Do List Member WordPress plugin
- Affected versions: Versions up to and including 1.6 (affected version entry references 1.4 with <= 1.6)
- Published: September 21, 2026 at 9:17:06 AM UTC
- Last modified: September 21, 2026 at 3:17:33 PM UTC
- CVSS v3.1: Base score 3.7, LOW —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No privileges required (PR:N), no user interaction required (UI:N); attack complexity is HIGH (AC:H)
- Impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness: CWE-862 (Authorization bypass)
Technical Details
The plugin implements an import routine that does not perform authorization or nonce checks and does not validate the remote location from which it fetches imported data. Because those checks are missing, unauthenticated requests can trigger the import logic and supply content that the plugin will use to create published posts and taxonomy terms.
The vulnerability exists due to absent access control and input/source validation in the import flow. The CVE description specifically identifies missing authorization and nonce checks and a lack of validation of the import source location as the root causes. No specific function names or REST endpoints are provided in the available data.
Impact is limited to the ability to create content and taxonomy entries (integrity impact assessed as Low). The issue does not indicate direct disclosure of confidential data or availability disruption based on the provided information.
How This Could Impact Your Website
In a realistic scenario, an external unauthenticated actor could use the import routine to create published posts or taxonomy terms that appear on the site. For example, a site owner and internal staff (editors or contributors) might find unexpected published content or new categories/tags visible to visitors. An external contractor or contributor who reviews site content could be misled by injected posts or taxonomy entries, increasing the chance of content confusion or reputational issues.
Practical consequences include the presence of unwanted or misleading published content, cluttered taxonomies that affect navigation and content discovery, and potential misuse of site content for social engineering that relies on visible site content rather than exposed private data. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and published content for unusual or unexpected changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team is happy to help.
