Description

The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and taxonomy terms on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-21T09:17:06.157Z",
  "pubdate": "2026-09-21T09:17:06.157Z",
  "executiveSummary": "The To Do List Member WordPress plugin through version 1.6 is susceptible to an unauthenticated arbitrary post and taxonomy creation vulnerability.\nThe security flaw resides in an inadequately protected import routine that lacks necessary authorization checks and cryptographic nonce validation.\nBy bypassing these security controls, an unauthenticated remote attacker can force the application to fetch and import malicious data from an arbitrary location.\nThis vulnerability allows unauthorized actors to inject arbitrary published posts and create taxonomy terms within the WordPress environment.\nThe risk implication is severe, as it grants attackers the ability to manipulate site content and information architecture without requiring administrative or user-level credentials.\nThe exploitation does not require prior authentication, making it highly accessible to external threat actors over the network.",
  "technicalDetails": "The vulnerability originates in the plugin's import functionality, which fails to implement secure access control mechanisms. Specifically, the import routine lacks an authentication check and does not utilize WordPress nonces (number used once) to verify that the request originated from a legitimate administrative source.\nThe root cause is an insecure implementation of a data import handler that trusts user-supplied input to define the source location of the data to be processed. Because the function does not validate or sanitize the target URL/path, it is susceptible to Server-Side Request Forgery (SSRF) patterns or direct injection of malicious import payloads.\nThe attack flow follows a predictable pattern: 1) An unauthenticated attacker identifies the vulnerable import endpoint exposed by the plugin. 2) The attacker crafts an HTTP request targeting this endpoint, providing an external or internal URI controlled by the attacker as the source for the import. 3) The plugin's back-end process, executing with the privileges of the web server, reaches out to the attacker-defined source. 4) The plugin parses the fetched data and interprets the contents as valid input for creating new posts and taxonomy terms within the WordPress database. 5) The application automatically publishes the resulting content, effectively bypassing the standard moderation and editorial workflows of the WordPress CMS.\nAffected versions include all instances of To Do List Member up to and including version 1.6. The exposure is total, as the vulnerable function is accessible via the network to any unauthenticated user who can reach the WordPress site. The payload behavior involves the automatic instantiation of database records corresponding to post objects and taxonomy taxonomies. Post-exploitation impact includes the potential for large-scale content spamming, defacement, the dissemination of phishing links, or the injection of malicious scripts into the site's front-end via the created posts."
}