EUVD-2026-83563
GHSA-4cq5-hfg6-vrqv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable and unauthenticated (AV:N/PR:N), but requiring a valid merchant-scoped TikTok auth_code that TikTok validates raises complexity to AC:H; impact is integrity-only (I:L), no confidentiality or availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.
AnalysisAI
The TikTok for Business WordPress plugin (all versions up to and including 1.4.1) fails to verify authorization on its TikTok OAuth token-exchange handler, allowing an unauthenticated remote request to overwrite the merchant's stored TikTok integration access token in the wp_options table and effectively hijack the site's TikTok Business account and product catalog link. Exploitation is heavily constrained: the request must carry a valid TikTok OAuth auth_code issued specifically for that merchant's registered TikTok app, and the plugin only persists the new token after TikTok's API returns message='OK', so forged or arbitrary codes fail. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation targets the plugin's TikTok OAuth token-exchange handler which performs no capability/authorization check, so it is reachable by unauthenticated requests (PR:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a high-CVSS-adjacent but genuinely LOW real-world-risk issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the TikTok for Business plugin beyond 1.4.1 as soon as a patched release is published - the vendor has already committed a fix to the plugin repository (Trac changeset r3699236 for tiktok-for-business: https://plugins.trac.wordpress.org/changeset?reponame=&old=3699236%40tiktok-for-business&new=3699236%40tiktok-for-business), so an upstream fix is available but the corresponding released version number is not independently confirmed in the available data; verify the installed version against the plugin's changelog before assuming you are covered. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today