CVE-2026-6446

The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via the 'ttp_get_accounts' AJAX action. This is due to the complete absence of authorization checks (no capability verification) and nonce verification in the get_accounts() function, which returns the full contents of the 'ttp_tiktok_accounts' WordPress option. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive TikTok OAuth credentials, including access_token and refresh_token values, that belong to administrator-connected TikTok accounts, enabling them to impersonate the site owner when interacting with the TikTok API.

• CWE-522

• https://plugins.trac.wordpress.org/browser/my-social-feeds/tags/1.0.2/includes/TiktokAPI.php#L190
• https://plugins.trac.wordpress.org/browser/my-social-feeds/tags/1.0.2/includes/TiktokAPI.php#L24
• https://plugins.trac.wordpress.org/browser/my-social-feeds/trunk/includes/TiktokAPI.php#L190
• https://plugins.trac.wordpress.org/browser/my-social-feeds/trunk/includes/TiktokAPI.php#L24
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3514796%40my-social-feeds&new=3514796%40my-social-feeds&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d46d6493-8b89-4258-9d83-79e5946cd76f?source=cve

Published

May 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-64454In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64455In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64456In the Linux kernel, the following vulnerability has been re…7.7
• CVE-2026-64457In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64458In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64459In the Linux kernel, the following vulnerability has been re…9.8
• CVE-2026-64460In the Linux kernel, the following vulnerability has been re…7
• CVE-2026-64461In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64462In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64463In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-64464In the Linux kernel, the following vulnerability has been re…
• CVE-2026-64465In the Linux kernel, the following vulnerability has been re…