rootpwn

medium · CVSS v3 5.3 · EPSS 0.0026

CVE-2026-18346

The TikTok plugin for WordPress (up to 1.4.1) contains an authorization bypass that lets unauthenticated users overwrite the stored TikTok a

Overview

The TikTok plugin for WordPress (up to 1.4.1) contains an authorization bypass that lets unauthenticated users overwrite the stored TikTok access token. This can lead to hijacking of the site’s TikTok Business and product catalog integration. The flaw requires a valid TikTok OAuth auth_code but is otherwise easy to trigger.

Description

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.

Impact

Confidentiality: unauthorized access to TikTok integration data; Integrity: token overwritten; Availability: potential disruption of TikTok catalog updates. Site owners and administrators are impacted.

Remediation

Update the TikTok plugin to version 1.4.2 or later. If an update is not possible, disable the plugin or restrict access to the token exchange endpoint via role‑based access control. Monitor wp_options for unexpected changes to the TikTok access token.

Risk context

The vulnerability has a medium severity score (CVSS 5.3) and a very low EPSS of 0.0026, indicating limited likelihood of exploitation, but defenders should still patch promptly to prevent potential hijacking.

Affected products

  • WordPress TikTok plugin 1.4.1
  • WordPress

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
0.0026

WordPress TikTok Authorization Bypass Plugin Token Hijacking Medium Severity

← All CVEs

Related CVEs

medium

CVE-2026-93956

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used. Upgrading to version 1.1.3 can resolve this issue. This patch is called 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-93957

A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

View analysis

medium

CVE-2026-75959

The GoPay for WooCommerce plugin for WordPress has a SQL injection vulnerability in the log_table_filter parameter. Authenticated shop managers can inject arbitrary SQL to read sensitive data. This affects all versions up to 1.0.36.

View analysis

medium

CVE-2026-1256

The YS LeadGen plugin for WordPress is vulnerable to authorization bypass and Stored Cross-Site Scripting via multiple AJAX endpoints in all versions up to, and including, 2.1.4 due to missing capability checks on popup management actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary popups and inject malicious JavaScript that executes when the popup is displayed, leading to Stored XSS.

View analysis