Sensitive Information Exposure in My Social Feeds Plugin for WordPress

CVE-2026-6446

What is CVE-2026-6446?

The My Social Feeds – Social Feeds Embedder plugin for WordPress has a significant vulnerability stemming from a lack of authorization checks in the 'ttp_get_accounts' AJAX action. This flaw allows authenticated users, with access levels starting from Subscriber, to exploit the get_accounts() function. Consequently, they can retrieve sensitive OAuth credentials associated with TikTok accounts that are linked to site administrators. The missing capability verification and nonce validation facilitate the unauthorized access to sensitive information such as access_token and refresh_token values, ultimately permitting attackers to impersonate the site owner while interacting with the TikTok API.

References