CVE-2026-86802

LOWCVSS 3.7

Description

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.

Timeline

Published:September 21st, 2026 9:17 AM

Last modified:September 21st, 2026 3:17 PM

CVSS Scoring

CVSS v3: 3.7 (LOW)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-862

References & Reports

Advisories, patches, and third-party reports

https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/

Source: NIST NVD · Data may lag official sources by up to one minute