CVE-2026-92965: TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption
The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using the TikTok WordPress plugin before version 1.4.2 are affected. Because the callback runs on every site request rather than only during an administrator sign-in, exposure is not limited to administrative pages or authenticated visitors.
What does an attacker need to exploit it?
An attacker only needs to visit the site with a URL containing a sign-in code of their choosing. No authorization check is performed before the site redeems that code against the advertising platform using the site's credentials.
Are near-match callback URLs also a concern?
Yes. The plugin matches the supplied code URL loosely, so URLs that merely resemble the expected callback URL can trigger redemption.
How can I determine whether my site is affected?
Check the installed TikTok WordPress plugin version. Versions earlier than 1.4.2 are affected.