Description

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-19T09:16:33.553Z",
  "pubdate": "2026-09-19T09:16:33.553Z",
  "executiveSummary": "The TikTok plugin for WordPress (all versions up to and including 1.4.1) contains a critical authorization bypass vulnerability.\nThe flaw allows unauthenticated remote attackers to overwrite the merchant's stored TikTok integration access token within the wp_options table.\nBy manipulating the token exchange process, an attacker can hijack the target site's TikTok Business and product catalog integration.\nThe vulnerability stems from the plugin's failure to properly verify user authorization during the OAuth callback handling process.\nSuccessful exploitation requires the attacker to possess a valid TikTok OAuth auth_code generated for the merchant's registered TikTok application.\nThis represents a significant security risk, as it facilitates unauthorized access to, or manipulation of, the merchant's TikTok ecosystem integration, potentially leading to data exposure, service disruption, or unauthorized product management.",
  "technicalDetails": "The vulnerability resides in the TikTok plugin's OAuth token exchange mechanism. The root cause is an improper authorization check during the callback sequence, which fails to validate the request origin or the user's administrative privileges before processing token updates.\nThe attack flow begins when an attacker identifies the vulnerable endpoint responsible for handling the TikTok OAuth callback. An attacker can supply a malicious or attacker-controlled TikTok OAuth auth_code to the plugin's endpoint.\nBecause the plugin lacks authentication verification, it proceeds to exchange the provided auth_code with the TikTok API. Provided the TikTok API returns a successful 'message=OK' response, the plugin logic assumes the request is legitimate.\nThe application then proceeds to update the stored TikTok access token within the WordPress database (specifically the wp_options table). By successfully executing this flow, the attacker overwrites the existing legitimate access token with one under their control.\nThis hijacked state allows the attacker to gain control over the merchant's TikTok Business integration. Impact includes the ability to intercept product catalog data, modify integration settings, or potentially access sensitive business metadata associated with the TikTok merchant account.\nThe vulnerability is present in all versions up to and including 1.4.1. Exploitation is performed remotely and does not require prior authentication to the WordPress site, though it does mandate that the attacker obtains a valid OAuth auth_code for the merchant's TikTok application, effectively leveraging the plugin's own trust in the TikTok API handshake to bypass local authentication controls."
}