To Do List Member
Monthly
Unauthenticated file upload in the To Do List Member WordPress plugin (versions 1.4 through 1.6) lets any remote attacker stage attacker-controlled files - including active content such as PHP payloads served from the site's own origin - and also enumerate and delete files already staged there. The plugin ships a standalone upload endpoint that never bootstraps WordPress, so no authentication, capability, or nonce check is ever performed, and only the uploaded filename is validated rather than the file's contents. Publicly available exploit code exists (reported by WPScan), and our assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact - no victim interaction is required, contrary to the vendor vector's UI:R - with the practical limit on real-world risk being the plugin's niche deployment footprint plus any WAF or perimeter rule that blocks direct requests to the endpoint or PHP execution in the upload directory.
Unauthenticated file upload in the To Do List Member WordPress plugin (versions 1.4 through 1.6) lets any remote attacker stage attacker-controlled files - including active content such as PHP payloads served from the site's own origin - and also enumerate and delete files already staged there. The plugin ships a standalone upload endpoint that never bootstraps WordPress, so no authentication, capability, or nonce check is ever performed, and only the uploaded filename is validated rather than the file's contents. Publicly available exploit code exists (reported by WPScan), and our assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact - no victim interaction is required, contrary to the vendor vector's UI:R - with the practical limit on real-world risk being the plugin's niche deployment footprint plus any WAF or perimeter rule that blocks direct requests to the endpoint or PHP execution in the upload directory.