To Do List Member vulnerabilities
We track 1 vulnerability in To Do List Member products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
1vulnerabilities
0critical
1high
0exploited
8.8average CVSS score
Latest To Do List Member vulnerabilities
- 8.8 High severity
To Do List Member: Missing Authentication for Critical Functionality
The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than it