CVE-2026-86802

Status: DeferredLow (3.7)—

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Base score: 3.7

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.25%
Percentile among all scored CVEs: 15
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access75 %
Primary impactT1078.001 Default Accountsstealth · persistence · privilege escalation · initial access65 %
Secondary impactT1565.001 Stored Data Manipulationimpact70 %

Plugin WordPress sin validación de autorización en rutina de importación (CWE-862). AV:N sin autenticación requerida permite creación de posts y términos, equivalente a ganancia de acceso con privilegios elevados e inyección de contenido.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Vulnerability Scanning Restrict File and Directory Permissions Privileged Account Management Password Policies Remote Data Storage Network Segmentation

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

TO DO List Member — TO DO List Member^AI

CWEs

CWE-862

References

https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-86802",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-86802",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-21T13:56:30.367751Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "contact@wpscan.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.7,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "contact@wpscan.com",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "To Do List Member",
          "versions": [
            {
              "status": "affected",
              "version": "1.4",
              "versionType": "semver",
              "lessThanOrEqual": "1.6"
            }
          ],
          "collectionURL": "https://wordpress.org/plugins",
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-09-21T09:17:06.157",
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/",
      "source": "contact@wpscan.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site."
    }
  ],
  "lastModified": "2026-09-21T15:17:33.130",
  "sourceIdentifier": "contact@wpscan.com"
}