To Do List Member CVE-2026-86801

No authentication, capability, or nonce is required because the vulnerable upload endpoint does not load WordPress at all - the only gate is a filename check, which does not inspect file content, so a PHP payload with an acceptable name is accepted. Preconditions: the To Do List Member plugin version 1.4 through 1.6 must be installed and active, and the standalone upload endpoint must be reachable over the network. Limiting factors are minimal: exploitation works against default configurations with no victim interaction (contradicting the vector's UI:R), the main constraint being the plugin's niche deployment footprint and any perimeter/WAF rules blocking direct requests to the endpoint or execution of files in the upload directory.

This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The root cause is architecturally severe: the file upload endpoint does not bootstrap WordPress, so it enforces NO authentication, capability, or nonce check whatsoever, and it validates only the uploaded file's name - never its content. That allows an unauthenticated attacker to store executable/active content served from the site's own origin (a classic PHP webshell path to RCE), plus list and delete staged files. The vendor CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) already reflects unauthenticated network exploitation with full CIA impact. NOTE A CONFLICT: the vector includes UI:R (user interaction required), yet the description describes a directly reachable endpoint that 'unauthenticated users' hit with no victim action - UI:N is more defensible, which would raise the score toward 9.8; verify with WPScan/vendor. Publicly available exploit code exists (WPScan), materially increasing near-term exploitation likelihood for internet-facing WordPress sites. No EPSS score and no CISA KEV entry were provided, so active exploitation is NOT confirmed - but absence of EPSS/KEV data should not downgrade urgency given unauthenticated RCE plus public PoC.

An unauthenticated attacker sends a crafted multipart POST to the plugin's standalone upload endpoint, uploading a file whose name passes the name-only filter while its body contains PHP code. Because the endpoint never loads WordPress, no auth/nonce/capability check runs, so the payload is stored under the site origin and can then be requested directly to execute as a webshell. Publicly available exploit code (WPScan) lowers the skill barrier; the attacker can also enumerate and delete previously staged files via the same endpoint.