TikTok WordPress Plugin CVE-2026-92965

Exploitable only against a WordPress site running the TikTok plugin versions 1.2.0 through before 1.4.2 that has (or is establishing) a connection to the TikTok advertising platform via its OAuth/sign-in callback. No authentication or user interaction is required (PR:N/UI:N) because the vulnerable callback runs on every request to the site and matches the expected sign-in URL loosely rather than only on the administrator's sign-in flow. The key limiting factor is that the attacker must supply a valid TikTok sign-in/authorization code to be redeemed (reflected as AC:H); impact is confined to the site's TikTok advertising connection (integrity-only), with no read access to site data and no availability impact.

This is a genuinely low-priority issue despite being unauthenticated and remotely reachable. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, base 3.7) correctly captures the profile: no confidentiality or availability impact and only a Low integrity impact, because the flaw lets an attacker corrupt or hijack the site's TikTok advertising-platform connection rather than compromise the WordPress site itself. AC:H is justified - the attacker must supply a valid TikTok sign-in/authorization code to be redeemed, which is not trivially forged. A public exploit exists (WPScan e74a467a), so publicly available exploit code exists, but there is no EPSS score, no CISA KEV listing, and no evidence of active exploitation in the provided data - POC availability must not be conflated with exploitation. SSVC-style reasoning: exploitation status is POC-only, technical impact is partial (integrity-only, scoped to the ad connection, S:U), so this does not rise to a priority patch. Net: a legitimate CWE-862 missing-authorization bug but low real-world risk; patch on a normal cycle.

An attacker crafts a URL against a WordPress site running the vulnerable TikTok plugin that carries an attacker-chosen TikTok sign-in code; because the callback runs on every request and matches the expected URL loosely, no admin action is required. The site redeems the attacker's code against the TikTok advertising platform using its own credentials, binding the attacker's ad account to the site or corrupting the legitimate connection. A public POC is available via WPScan, but the attacker must first obtain a usable sign-in code (AC:H).