What is the CVSS score of CVE-2026-6446?

CVE-2026-6446 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

My Social Feeds - Social Feeds Embedder CVE-2026-6446

EUVD-2026-26735 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-05-02 security@wordfence.com

WordPress Information Disclosure

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 02, 2026 - 05:31 vuln.today

EUVD ID Assigned

May 02, 2026 - 05:22 euvd

EUVD-2026-26735

Analysis Generated

May 02, 2026 - 05:22 vuln.today

CVE Published

May 02, 2026 - 05:16 nvd

MEDIUM 5.4

DescriptionCVE.org

The My Social Feeds - Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via the 'ttp_get_accounts' AJAX action. This is due to the complete absence of authorization checks (no capability verification) and nonce verification in the get_accounts() function, which returns the full contents of the 'ttp_tiktok_accounts' WordPress option. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive TikTok OAuth credentials, including access_token and refresh_token values, that belong to administrator-connected TikTok accounts, enabling them to impersonate the site owner when interacting with the TikTok API.

AnalysisAI

My Social Feeds - Social Feeds Embedder WordPress plugin up to version 1.0.4 exposes sensitive TikTok OAuth credentials via an unauthenticated AJAX endpoint due to missing authorization and nonce checks. Authenticated attackers with Subscriber-level access can retrieve stored access_token and refresh_token values belonging to administrator-connected TikTok accounts, enabling them to impersonate the site owner in TikTok API interactions. No public exploit code or active exploitation has been reported at the time of analysis, though the vulnerability is trivial to exploit once network access is established.

Technical ContextAI

The vulnerability exists in the get_accounts() function within the TiktokAPI.php component, which handles the 'ttp_get_accounts' AJAX action. The function directly returns the full contents of the 'ttp_tiktok_accounts' WordPress option without verifying the caller's WordPress user role or capabilities (PR:L in CVSS indicates authentication is required, but no capability check constrains which authenticated users can invoke the action). Additionally, the absence of nonce validation means CSRF protections are absent. The root cause is classified under CWE-522 (Insecure Storage of Sensitive Information), though the immediate mechanism is insufficient access control. The affected plugin is available on the WordPress.org plugin repository and interacts with the TikTok API to embed social content; the stored credentials grant full OAuth authorization to third-party TikTok accounts.

RemediationAI

Update My Social Feeds - Social Feeds Embedder to version 1.0.5 or later, which should address the authorization and nonce verification gaps (exact patch version not confirmed in provided data; check plugin repository release notes). If an immediate update is not possible, disable the plugin entirely until a patch is available, as the AJAX endpoint is accessible to all authenticated users and no configuration option can disable the vulnerable functionality. As a temporary compensating control, restrict user registration to trusted administrators only, reducing the attack surface to internal threats, though this does not address the underlying authorization flaw. WordPress administrators should audit their TikTok OAuth token storage: if the 'ttp_tiktok_accounts' option contains tokens from before the patch, those tokens should be revoked immediately via TikTok's app authorization settings and regenerated after the plugin is patched. Network-level mitigation (e.g., WAF rules blocking 'action=ttp_get_accounts' AJAX calls) is not recommended as it may break legitimate plugin functionality; instead, prioritize patching.