CVE-2026-86801: To Do List Member Plugin Auth Bypass Flaw

CVE-2026-86801 Overview

The To Do List Member WordPress plugin versions 1.4 through 1.6 exposes an unauthenticated file upload endpoint. The endpoint does not bootstrap WordPress, so it enforces no authentication, capability, or nonce checks. It also validates only the filename, not the content, of uploaded files. Unauthenticated attackers can store active content served from the site's own origin, list staged files, and delete existing files. This missing authentication [CWE-306] allows attackers to plant scripts that execute in the site context, enabling cross-origin attacks against administrators and site visitors.

Critical Impact
Unauthenticated remote attackers can upload, list, and delete files on affected WordPress sites, staging active content served from the trusted origin.

Affected Products

To Do List Member WordPress plugin version 1.4
To Do List Member WordPress plugin version 1.5
To Do List Member WordPress plugin version 1.6

Discovery Timeline

2026-09-17 - CVE-2026-86801 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-86801

Vulnerability Analysis

The vulnerability affects a file upload endpoint shipped with the To Do List Member WordPress plugin. The endpoint script executes without loading the WordPress runtime. As a result, no authentication check, capability verification, or nonce validation runs before the upload proceeds. Attackers reach the endpoint directly over the network without valid credentials.

The upload handler inspects only the filename extension of the submitted file, not the actual byte content. An attacker can craft a file with a permitted extension while embedding active content such as HTML or JavaScript. The uploaded file is stored inside the site's document root and served from the plugin's origin. Content executing under the site origin bypasses same-origin protections that browsers would apply to third-party content. In addition to uploading, the same interface allows unauthenticated callers to enumerate existing staged files and delete them, providing integrity and availability impact alongside confidentiality risk.

Root Cause

The root cause is a Missing Authentication for Critical Function issue [CWE-306]. The upload script does not include WordPress core, which is where authentication, capability, and nonce mechanisms live. Combined with weak file-type validation based solely on filename, the endpoint accepts arbitrary content from anonymous callers.

Attack Vector

The attack requires network access to the WordPress site and user interaction on the victim side when the staged content is delivered. An attacker sends an HTTP POST request to the vulnerable upload endpoint with a crafted filename and payload. The uploaded file then becomes reachable at a predictable URL under the plugin directory. Attackers can chain this with social engineering, phishing links, or embedded references to trigger execution of the staged content in browsers of administrators or site visitors.

See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-86801

Indicators of Compromise

Unexpected files with executable or scriptable extensions within the To Do List Member plugin upload directory under wp-content/plugins/.
HTTP POST requests to the plugin's standalone upload endpoint from unauthenticated sources or without a valid WordPress session cookie.
File names that do not match the site's normal upload naming conventions, particularly those referencing HTML, SVG, or script content.

Detection Strategies

Monitor web server access logs for POST requests targeting PHP scripts inside the To Do List Member plugin directory that return HTTP 200 without an authenticated referer.
Alert on file creation events in the plugin's upload path where the file MIME type does not match its extension.
Correlate anonymous upload requests with subsequent GET requests to the same file path from external IP addresses.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/plugins/ and any writable upload directories used by the plugin.
Ingest WordPress web server and PHP-FPM logs into a centralized logging platform for retention and query.
Track outbound requests from WordPress hosts that could indicate a staged payload has been triggered by an administrator browser.

How to Mitigate CVE-2026-86801

Immediate Actions Required

Deactivate and remove the To Do List Member plugin from all WordPress sites until a fixed version is published.
Audit the plugin's upload directory for unknown files and remove any content not created by legitimate site operations.
Rotate WordPress administrator passwords and session tokens if unauthorized files are found.

Patch Information

No patched version is identified in the referenced advisory. Track the WPScan Vulnerability Report for updates from the plugin maintainer and apply a fixed release when available.

Workarounds

Block direct HTTP access to the vulnerable upload endpoint at the web server or web application firewall layer.
Restrict write permissions on the plugin directory so the web server user cannot create new files.
Serve the plugin's upload directory with a restrictive Content-Security-Policy and X-Content-Type-Options: nosniff header to reduce browser execution of staged content.

bash

# Example nginx location block to deny access to the vulnerable endpoint
location ~* /wp-content/plugins/to-do-list-member/.*\.php$ {
    deny all;
    return 403;
}