CVE-2026-18346: TikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wpoptions, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth authcode issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TikTok plugin for WordPressto a version that resolves this vulnerability.Fixed in 1.4.1 - Compensating control
Restrict access to any WordPress endpoints that perform TikTok OAuth token exchange so only authenticated/authorized users (authorized to manage the merchant’s TikTok integration) can trigger the overwriting of the stored TikTok access token in wp_options.
- Operational
Because unauthenticated attackers may have overwritten the merchant's stored TikTok integration access token in wp_options, rotate/reissue the TikTok integration credentials and confirm wp_options has the expected token value for the merchant’s registered TikTok app.
Event History
Frequently Asked Questions
What must an attacker obtain to exploit this issue?
The attacker must supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app. The plugin overwrites the stored token only if TikTok's API token exchange returns message='OK'.
What can an attacker change after successful exploitation?
An unauthenticated attacker can overwrite the TikTok integration access token stored in WordPress wp_options. This can hijack the site's TikTok Business and product catalog integration.
Are unauthenticated attackers affected by any authorization requirement in WordPress?
No. The authorization bypass allows unauthenticated attackers to perform the token-overwrite action, provided they meet the separate requirement for a valid OAuth auth_code.