CVE-2026-86802 To Do List Member CVE debrief

Who should care

Site administrators and security teams responsible for WordPress installations should be aware of this vulnerability and assess their exposure. They should verify the presence of this vulnerability in their installations and assess the potential impact on their sites.

Why it matters

CVE-2026-86802 is a low-severity vulnerability in the To Do List Member WordPress plugin that allows unauthenticated users to create arbitrary content. Site administrators and security teams should verify the presence of this vulnerability in their installations and assess the potential impact.

• Potential creation of arbitrary published posts
• Potential creation of arbitrary taxonomy terms
• Verification of plugin version and vulnerability presence required
• Assessment of site exposure and potential impact necessary

Technical summary

The To Do List Member WordPress plugin through version 1.6 does not have authorization or nonce checks in an import routine. It also does not validate the location it fetches the imported data from. This allows unauthenticated users to create arbitrary published posts and taxonomy terms on the site. The vulnerability has a CVSS score of 3.7 and is considered low severity. Site administrators and security teams should verify the presence of this vulnerability in their WordPress installations and assess the potential impact on their sites.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess the potential impact on their sites.

Recommended defensive actions

• Verify the presence of this vulnerability in WordPress installations
• Assess the potential impact on sites
• Consider updating the plugin to a version that addresses this issue
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The evidence for this vulnerability comes from the NVD and a source reference from WPScan. However, the details about the vulnerability's impact and remediation are limited. Site administrators and security teams should verify the presence, of this vulnerability in their WordPress installations and assess the potential impact on their sites. The plugin's lack of authorization and nonce checks in the import routine, combined with the absence of validation for the data import location, allows unauthenticated users to create arbitrary, 1

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.