CVE-2026-86802CWE-862broken-access-control

CVE-2026-86802

Low · published September 21, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-21T13:17Z
References (1)
https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/ · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 21 SEP 08:51Z
    To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import
    cvelistv5