CVE-2026-86802
📛 CVE Title
To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import
Description
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- WPScan
- CVSS severity
- LOW
- CVSS score
- 3.7 / 10
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N- Effective score
- 3.7 / 10 LOW source: CNA overview
- CWE(s)
-
CWE-862 Missing Authorization - Reserved
- 2026-09-08
- Published
- 2026-09-21 08:51 UTC
- Last updated
- 2026-09-21 14:30 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/86xxx/CVE-2026-86802.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-09-21 09:17:06 UTC
- NVD last modified
- 2026-09-21 15:17:33 UTC
- NVD CVSS v3.1
- 3.7 / 10 LOW source: contact@wpscan.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N- Exploitability subscore
- 2.2 / 10
- Impact subscore
- 1.4 / 10
- EPSS score
- 0.0016 (probability of exploitation in next 30 days)
- EPSS percentile
- 5.36% vs all CVEs — higher = more likely to be exploited, as of 2026-09-21
NVD-assigned CWE(s):
CWE-862
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-09-22 03:35 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-83869 - Assigner
- WPScan
- Published
- Sep 21, 2026, 8:51:52 AM
- Updated
- Sep 21, 2026, 2:30:39 PM
- EUVD base score (CVSS 3.1)
-
3.7 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - EUVD-reported EPSS
- 0.1600
- Vendors
- Unknown
- Products
-
To Do List Member (1.4 ≤1.6)
- Aliases
-
GHSA-p5g8-hwm5-93cc
ENISA description: The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Unknown | To Do List Member |
1.4 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/ exploitvdb-entrytechnical-description
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
NVD-tagged references (1)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/ contact@wpscan.com
Remediations (10)
-
web:blog.qualys.com
Executive Summary CVE - 2026 -68820 is an actively exploited Windows vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) Catalog, with a remediation deadline as suggested by CISA BOD 26-04. CISA BOD 26-04 introduces risk-based remediation timelines ranging from 3 to 14 days, increasing the pressure on teams to move quickly from patch availability to verified remediation ...
2026-09-22 17:08 UTC -
web:cybersecuritynews.com
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued Binding Operational Directive (BOD) 26-04, titled "Prioritizing Security Updates Based on Risk," compelling all Federal Civilian Executive Branch (FCEB) agencies to remediate the most dangerous known exploited vulnerabilities within just three calendar days.
2026-09-22 17:08 UTC -
web:msrc.microsoft.com
The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.
2026-09-22 17:08 UTC -
web:support.microsoft.com
Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...
2026-09-22 17:08 UTC -
web:tech-insider.org
Microsoft patches 421 CVEs in August 2026 Patch Tuesday, including WinSock zero-day CVE - 2026 -68820 under active attack. Full breakdown here.
2026-09-22 17:08 UTC -
web:www.cisa.gov
BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
2026-09-22 17:08 UTC -
web:www.cisecurity.org
<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...
2026-09-22 17:08 UTC -
web:www.helpnetsecurity.com
Microsoft's August 2026 Patch Tuesday delivered 400+ security fixes, including one for an actively exploited zero-day flaw ( CVE - 2026 -68820).
2026-09-22 17:08 UTC -
web:www.hivepro.com
Microsoft's August 2026 Patch Tuesday addresses 423 vulnerabilities including the actively exploited Windows AFD.sys zero-day CVE - 2026 -68820. Priority CVEs , patch guidance, and IOCs inside.
2026-09-22 17:08 UTC -
web:www.tenable.com
Microsoft patched 398 CVEs in August including three zero-day flaws, one exploited in the wild: CVE - 2026 -68820 in the Windows Ancillary Function Driver for WinSock.
2026-09-22 17:08 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-86802.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86802",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T13:56:30.367751Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T14:30:39.753Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://wordpress.org/plugins",
"defaultStatus": "unknown",
"product": "To Do List Member",
"vendor": "Unknown",
"versions": [
{
"lessThanOrEqual": "1.6",
"status": "affected",
"version": "1.4",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Pablo Gonz\u00e1lez P\u00e9rez"
},
{
"lang": "en",
"type": "finder",
"value": "Francisco Jos\u00e9 Ram\u00edrez Vicente"
},
{
"lang": "en",
"type": "finder",
"value": "I\u00f1igo S\u00e1nchez Enciso"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T08:51:52.409Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/71c678eb-35f8-4eac-a4bb-b71bdcb2ca4e/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-86802",
"datePublished": "2026-09-21T08:51:52.409Z",
"dateReserved": "2026-09-08T12:23:07.778Z",
"dateUpdated": "2026-09-21T14:30:39.753Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}