Executive brief
The To Do List Member WordPress plugin versions 1.4 through 1.6 contain an unprotected file upload endpoint that allows unauthenticated attackers to upload and execute malicious content (including stored XSS attacks) on the website, as well as list and delete previously uploaded files. This could allow attackers to inject malware, deface the site, or steal visitor data without needing any credentials or authorization.
Technical details
The vulnerability is a combination of unauthenticated file upload and stored XSS. The plugin ships a file upload endpoint that does not load WordPress initialization, thereby bypassing all authentication, capability checks, and nonce validation. The endpoint validates only the filename rather than file content, allowing arbitrary content to be uploaded. Because files are served from the site's own origin, uploaded active content (e.g., HTML, JavaScript, PHP) can execute with the same origin privileges, enabling stored XSS attacks against site visitors. Attackers can also enumerate and delete previously uploaded files. No authentication or user interaction is required for exploitation. A patch has not been identified at the time of this advisory.
Affected products
- WordPress To Do List Member 1.4 through 1.6
Timeline
- 2026-09-15: disclosed: Publicly published on WPScan
- 2026-09-17: advisory: NVD entry published