CVE-2026-86802: To Do List Member WordPress Auth Bypass

CVE-2026-86802 Overview

CVE-2026-86802 affects the To Do List Member WordPress plugin through version 1.6. The plugin exposes an import routine without authorization or nonce checks and fails to validate the remote location from which imported data is fetched. Unauthenticated attackers can trigger the import routine to create arbitrary published posts and taxonomy terms on the target site. The issue is classified as Missing Authorization [CWE-862].

Critical Impact
Unauthenticated remote attackers can inject arbitrary published posts and taxonomy terms into affected WordPress sites, enabling content pollution, SEO abuse, and potential distribution of malicious links.

Affected Products

To Do List Member WordPress plugin, all versions through 1.6
WordPress sites with the vulnerable plugin installed and active
Any hosting environment exposing the plugin's import endpoint to unauthenticated network traffic

Discovery Timeline

2026-09-21 - CVE-2026-86802 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-86802

Vulnerability Analysis

The vulnerability resides in an import routine exposed by the To Do List Member plugin. The routine lacks two standard WordPress protections: a capability or authorization check, and a nonce verification to bind requests to an authenticated session. It also does not validate the source location supplied for the imported data.

When invoked, the routine fetches remote content and translates it into WordPress posts and taxonomy terms. Because no origin restriction is applied, an attacker can point the routine at an arbitrary URL under their control. The imported records are created with published status, making injected content immediately visible to site visitors and search engines.

Root Cause

The root cause is missing authorization on a state-changing endpoint, combined with unrestricted external data retrieval. Standard WordPress hardening requires current_user_can() checks and wp_verify_nonce() validation on any handler that writes to the database. Neither control is present in the affected import path, and the fetch destination is not constrained to an allowlist.

Attack Vector

Exploitation requires network access to the WordPress site and knowledge of the vulnerable import endpoint. The attacker issues an HTTP request to the endpoint referencing a remote payload they control. The plugin retrieves the payload and creates posts and taxonomy terms based on its contents. No authentication, user interaction, or elevated privileges are needed. See the WPScan Vulnerability Report for endpoint-level details.

Detection Methods for CVE-2026-86802

Indicators of Compromise

Unexpected published posts or custom taxonomy terms that do not map to any authenticated author account
Outbound HTTP requests from the WordPress host to unfamiliar remote URLs originating from the plugin's import handler
Access log entries showing unauthenticated POST or GET requests targeting the To Do List Member plugin's import endpoint
Spikes in newly created posts within short time windows on sites running the plugin

Detection Strategies

Query the wp_posts and wp_terms tables for records created outside of expected editorial workflows and correlate with web server access logs
Monitor WordPress audit logs for post creation events attributed to no user or to the anonymous context
Alert on HTTP requests to plugin admin-ajax or REST routes when the requester is unauthenticated

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/todo-list-member/ directory
Forward WordPress and web server logs to a centralized analytics platform for correlation across sites
Track outbound network egress from PHP worker processes to identify unexpected remote fetches

How to Mitigate CVE-2026-86802

Immediate Actions Required

Deactivate the To Do List Member plugin on any site running version 1.6 or earlier until a patched release is available
Audit the site for injected posts and taxonomy terms and remove any unauthorized entries
Restrict access to the plugin's import endpoint at the web server or WAF layer to trusted IPs only

Patch Information

No fixed version has been published at the time of NVD disclosure. Monitor the WPScan Vulnerability Report and the plugin's WordPress.org listing for a security release addressing the missing authorization and unvalidated data source.

Workarounds

Block unauthenticated requests to the plugin's import route using a web application firewall rule
Require authentication in front of /wp-admin/admin-ajax.php and any plugin-specific REST endpoints where feasible
Replace the plugin with an alternative solution if the vendor does not issue a timely patch

bash

# Example nginx rule to block unauthenticated access to the plugin path
location ~* /wp-content/plugins/todo-list-member/ {
    deny all;
    return 403;
}