CVE-2026-86802

Summary

The flaw allows unauthenticated users to create arbitrary published posts and taxonomy terms by exploiting a lack of authorization and nonce checks in the import routine.

Exploitability

Exploitation requires access to the import feature, making it moderately difficult but feasible for attackers with knowledge of the plugin version.

Blast radius

If exploited, this could lead to unauthorized content creation on the WordPress site, potentially impacting user trust and site integrity.

Prioritized remediation

Update to the latest version of the To Do List Member WordPress plugin, which should address these security issues.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.