OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-86802

LOW · CVSS 3.7 EPSS 0.25%

Source: NVD + CISA KEV + EPSS · Published 2026-09-21 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The To Do List Member WordPress plugin, up to version 1.6, is vulnerable due to a lack of authorization and nonce checks in its import routine, allowing unauthenticated users to create arbitrary published posts and taxonomy terms. This could lead to unauthorized content manipulation on affected WordPress sites. WordPress administrators using this plugin should prioritize applying updates or implementing mitigations to prevent potential exploitation.

CVE
CVE-2026-86802
Severity
LOW
CVSS
3.7
EPSS
0.25%
WordPress

Original NVD Description

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.