Authorization Flaw in TikTok WordPress Plugin
CVE-2026-92965
Key Information:
Badges
What is CVE-2026-92965?
The TikTok WordPress Plugin prior to version 1.4.2 exhibits a critical authorization oversight that enables any user to redeem a sign-in code directly through the URL without proper verification. This flaw allows unauthorized visitors to interact with the advertising platform using the site's credentials, potentially leading to misuse of user data and resources. The vulnerability is exacerbated by the plugin's loose URL matching, which can trigger callbacks on every request, compromising the site's security regardless of the user’s authorization status.
Affected Version(s)
TikTok 1.2.0 < 1.4.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.