CVE-2026-18346

The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.

• CWE-862

• https://plugins.trac.wordpress.org/browser/tiktok-for-business/tags/1.4.0/admin/Tt4b_Menu_Class.php#L397
• https://plugins.trac.wordpress.org/browser/tiktok-for-business/tags/1.4.0/admin/Tt4b_Menu_Class.php#L417
• https://plugins.trac.wordpress.org/browser/tiktok-for-business/tags/1.4.0/admin/tt4b_menu.php#L13
• https://plugins.trac.wordpress.org/browser/tiktok-for-business/tags/1.4.0/mapi/Tt4b_Mapi_Class.php#L332
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3699236%40tiktok-for-business&new=3699236%40tiktok-for-business
• https://www.wordfence.com/threat-intel/vulnerabilities/id/31233f4e-4cd5-497f-9e8a-c65635596241?source=cve

Published

Sep 19, 2026

Last Modified

Sep 21, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18331The Formidable Forms – WordPress Form Builder for Contact Fo…7.2
• CVE-2026-18335The Kirki – Freeform Page Builder, Website Builder & Customi…5.4
• CVE-2026-1834The Ibtana – WordPress Website Builder plugin for WordPress …6.4
• CVE-2026-18341IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…8.8
• CVE-2026-18344The Wp Responsive Thumbnail Slider plugin for WordPress is v…6.1
• CVE-2026-18345The WP User Manager plugin for WordPress is vulnerable to un…4.3
• CVE-2026-18347The Kirki – Freeform Page Builder, Website Builder & Customi…4.3
• CVE-2026-18348Missing authorization check in the upload_azure, upload_sftp…4.1
• CVE-2026-18349Improper protection against voltage and clock glitches vulne…7.3
• CVE-2026-1835A vulnerability was identified in lcg0124 BootDo up to e93dd…4.3
• CVE-2026-18351The Drag and Drop File Upload for Elementor Forms plugin for…9.8
• CVE-2026-18352The User Access Manager plugin for WordPress is vulnerable t…7.5