The To Do List Member WordPress plugin for versions 1.4 through 1.6 contains a critical unauthenticated file upload vulnerability that risks total site compromise.

This vulnerability stems from a file upload endpoint that lacks authentication, capability, and nonce checks, allowing unauthenticated attackers to upload arbitrary files and perform unauthorized file management operations.

The ability for an unauthenticated user to upload active content to the server poses a severe threat, potentially leading to remote code execution and complete site takeover. Given the high CVSS score of 8.8, this vulnerability represents a significant risk to data integrity, system availability, and organizational reputation.

Immediate Action: As no patch is currently confirmed, administrators should immediately deactivate and remove the To Do List Member plugin from all WordPress installations until a vendor-verified fix is released.

Proactive Monitoring: Review web server access logs for requests to suspicious file paths or unexpected POST requests targeting file upload endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the specific plugin directories or suspicious file extensions commonly associated with web shell uploads.

Public Exploit Available: No

Due to the severity of this unauthenticated file upload vulnerability, immediate removal of the affected plugin is the only effective way to prevent exploitation. Security teams should prioritize this task across all production environments to eliminate the risk of remote code execution and unauthorized file manipulation.