The To Do List Member plugin for WordPress, versions 1.4 through 1.6, contains an import routine that lacks authorization or nonce checks. It also does not validate the source of the imported data, which allows an unauthenticated attacker to trigger the import and create arbitrary published posts and taxonomy terms on the site. This flaw enables the injection of content without authentication.

The affected product is the To Do List Member WordPress plugin, with vulnerable releases from 1.4 up to and including 1.6. These versions are distributed under an unknown vendor label and are deployed within standard WordPress installations on PHP‑enabled web servers.

The CVSS v3.0 score of 3.7 places this flaw in the low‑moderate range. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack vector inferred from the description is unauthenticated HTTP requests to the import endpoint, which allows any website visitor to trigger the import and inject content. While exploitation data is limited, the potential for content injection warrants prompt mitigation.