Description

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-20T07:16:51.453Z",
  "pubdate": "2026-09-20T07:16:51.453Z",
  "executiveSummary": "The TikTok WordPress plugin prior to version 1.4.2 contains a critical authorization bypass vulnerability related to insufficient access control during the OAuth sign-in flow.\nThe vulnerability allows an unauthenticated remote attacker to trigger a site-wide redemption of arbitrary advertising platform sign-in codes using the site's legitimate credentials.\nThe root cause stems from a failure to validate request authorization and an overly permissive execution scope for callback functions.\nImpact includes the potential for unauthorized integration of third-party advertising accounts and unauthorized synchronization between the WordPress installation and external TikTok advertising infrastructure.\nThe flaw allows any visitor to the site to initiate this logic, posing significant security risks to the site's advertising configuration and data integrity.\nNo specific attacker privileges are required for exploitation, as the plugin processes the malicious input on every incoming request without verifying the identity or session state of the requestor.",
  "technicalDetails": "The vulnerability is primarily characterized as a Broken Access Control issue within the plugin's sign-in handling logic. In affected versions (prior to 1.4.2), the plugin fails to implement mandatory nonces or session-based authentication checks when processing advertising platform callback parameters supplied via the URL.\nThe technical flow of the exploit involves an attacker crafting a request containing a malicious or arbitrary sign-in code. Because the plugin does not verify if the requesting user possesses administrative privileges or has initiated the OAuth handshake, it proceeds to process the supplied parameter immediately upon request arrival.\nFurther complicating the security posture, the plugin employs loose matching logic to identify target URLs. This means that URLs resembling the legitimate callback endpoint can trigger the plugin's internal callback function. This triggers a global execution condition where the callback routine runs on every single request made to the site, rather than being restricted to the administrative sign-in flow or the intended callback path.\nBy failing to restrict the scope of this callback functionality, the plugin forces the server to act on unauthorized inputs continuously. An attacker can leverage this to force the WordPress installation to redeem an attacker-controlled advertising sign-in code against the platform, effectively binding the site's credentials to the attacker's advertising account or disrupting the existing site-to-platform relationship.\nExploitation requires no special network access beyond standard HTTP(S) connectivity to the web server. The lack of input validation regarding the integrity of the sign-in code, combined with the lack of authentication, enables a trivial exploit vector where a simple GET request containing the necessary parameters is sufficient to execute the vulnerable code path.\nPost-exploitation, the server may have its TikTok advertising configuration hijacked, potentially leading to unauthorized ad expenditure, data exposure, or the manipulation of tracking pixels and site traffic analytics linked to the compromised TikTok for Business account."
}