CVE-2026-86801: To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.
Affected Software
Event History
Frequently Asked Questions
Who can exploit the upload handler?
Any unauthenticated remote user can reach it. The endpoint does not load WordPress, so no login, capability, or nonce validation is applied.
What can an attacker do through the exposed endpoint?
An attacker can upload active content that is served from the site's own origin, creating a stored cross-site scripting risk. They can also list files already staged in the upload location and delete them.
Does exploitation depend on a privileged WordPress account or a user action?
No privileged WordPress account is required to upload, list, or delete files. Successful XSS execution requires a user to interact with attacker-stored active content, as reflected by the user-interaction requirement.
Which plugin releases are affected?
The affected range is To Do List Member versions 1.4 through 1.6.