Unauthenticated File Upload in WordPress To Do List Plugin

The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The To Do List Member WordPress plugin versions 1.4 through 1.6 contain a critical file upload vulnerability that bypasses all WordPress security mechanisms. The vulnerable endpoint accepts file uploads without authentication checks, capability verification, or nonce validation—relying solely on filename validation rather than content inspection. This allows unauthenticated attackers to upload arbitrary active content (such as PHP files) that executes from the site's own origin, effectively giving attackers code execution capabilities. Any WordPress site running the affected plugin versions is at risk, with the vulnerability being particularly dangerous because it requires no prior access or credentials to exploit.

Casky's 283 matching security skills leverage Claude AI's extended reasoning to detect the attack patterns associated with this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners would identify suspicious indicators including: unauthorized file creation events in plugin upload directories, unexpected PHP or executable files appearing in web-accessible paths, HTTP requests to the vulnerable endpoint lacking standard WordPress authentication headers, and anomalous file listing/deletion operations from unauthenticated sources. The platform's skill mapping helps teams correlate these signals with the underlying CWE-306 (Missing Authentication for Critical Function) weakness, enabling detection of both exploitation attempts and post-compromise file staging behavior that attackers use to maintain persistence.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86801.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-86801

Casky has 283 skills that investigate the attack patterns behind CVE-2026-86801. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn