To Do List Member CVE-2026-86802

Exploitable against sites running the To Do List Member WordPress plugin version 1.6 or earlier. The vulnerable import routine performs no authorization or nonce validation, so any unauthenticated network attacker can invoke it. The routine also does not validate the location it fetches imported data from, so the attacker supplies or references a data source to be ingested. Impact is limited to creating arbitrary published posts and taxonomy terms - no read access to existing data, no code execution, and no availability impact. Realistic risk is capped by the plugin's small deployment footprint and the integrity-only outcome; the vendor's AC:H suggests some non-trivial setup (e.g. hosting the fetched data) is required.

This is a low-real-priority issue despite being unauthenticated. The vendor CVSS of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects the reality: no confidentiality impact, no availability impact, and only Low integrity impact. The attack is network-reachable by unauthenticated users (PR:N), but the impact is bounded to creating arbitrary published posts and taxonomy terms - i.e. content injection / spam / SEO poisoning - not code execution or data theft. No EPSS score, no CISA KEV listing, and no public exploit code were provided (only the WPScan advisory reference), so this is 'no public exploit identified at time of analysis.' The AC:H rating is worth scrutiny: a missing-authorization import endpoint is often trivially callable (arguing for AC:L), but the description's note that the routine 'fetches imported data from' an unvalidated location suggests the attacker may need to stand up and reference a remote data source, which plausibly supports AC:H. Note the 'Information Disclosure' tag conflicts with the actual impact - the CVSS is C:N/I:L, so this is an integrity/content-injection flaw, not disclosure. The unvalidated fetch location also hints at latent SSRF, but no confidentiality impact is claimed in the vector, so treat SSRF as unconfirmed.

An unauthenticated attacker sends a crafted request to the plugin's import routine, which lacks any authorization or nonce check, and points it at an attacker-controlled data source. The plugin ingests that data and creates arbitrary published posts and taxonomy terms on the victim WordPress site, enabling spam, malicious links, or SEO poisoning. No public proof-of-concept exploit was identified in the provided sources.