Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86801

To Do List Member · Vulnerability

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86801

Published

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86801

Published

To Do List Member

https://wordpress.org/plugins

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Unknown",
                    "product": "To Do List Member",
                    "versions": [
                        {
                            "status": "affected",
                            "versionType": "semver",
                            "version": "1.4",
                            "lessThanOrEqual": "1.6"
                        }
                    ],
                    "defaultStatus": "unknown",
                    "collectionURL": "https://wordpress.org/plugins"
                }

Original source record · Cite this exact observation · Complete original publisher JSON