CVE-2026-86802 is a vulnerability in the To Do List Member WordPress plugin through version 1.6. The plugin lacks authorization and nonce checks in an import routine and does not validate the location from which it fetches imported data. This allows unauthenticated users to create arbitrary published posts and taxonomy terms on the site. The CVSS score is 3.7, indicating a low severity.
CVE-2026-86801 debrief based on the supplied source corpus. The To Do List Member WordPress plugin from 1.4 through 1.6 has a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's o [truncated]
