Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86802— To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import

Quick assessment

Affected
Unknown To Do List Member
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

“To Do List Member”WordPress 插件 1.6 版本及更早版本存在一个安全漏洞：其数据导入功能中缺乏身份验证（authorization）和 CSRF nonce 检查，并且未对导入数据的来源位置进行验证。这可能导致未经身份验证的用户在网站上创建任意已发布的文章和分类项（taxonomy terms）。

CVSS 3.7 · Low
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-86802

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import
Source: CVE Program / CVE List V5
Vulnerability Description
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown To Do List Member 1.4 ~ 1.6 -

II. Public POCs for CVE-2026-86802

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86802

请登录查看更多情报信息。

Other References for CVE-2026-86802 (1)

Same Patch Batch · Unknown · 2026-09-21 · 5 CVEs total

CVE-2026-85113 6.5 MEDIUM GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
CVE-2026-92400 5.3 MEDIUM Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via San
CVE-2026-85010 5.3 MEDIUM RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons
CVE-2026-82187 WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Uplo

IV. Related Vulnerabilities

Same product: To Do List Member
Same vendor: Unknown

V. Comments for CVE-2026-86802

No comments yet

Leave a comment