Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-21
To Do List Member - Security Vulnerability (CVE-2026-86802)
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.
PLUGIN
To Do List Member
CVE-2026-86802
Risk Score
Threat Entry
Updated 2026-09-18
To Do List Member - Security Vulnerability (CVE-2026-86801)
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.
PLUGIN
To Do List Member
CVE-2026-86801
Risk Score