What the vulnerability does
01Description
The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via the 'ttp_get_accounts' AJAX action. This is due to the complete absence of authorization checks (no capability verification) and nonce verification in the get_accounts() function, which returns the full contents of the 'ttp_tiktok_accounts' WordPress option. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive TikTok OAuth credentials, including access_token and refresh_token values, that belong to administrator-connected TikTok accounts, enabling them to impersonate the site owner when interacting with the TikTok API.
Explanation of Vulnerability in Simple Terms
02Summary
The My Social Feeds plugin for WordPress versions 1.0.4 and earlier insufficiently protects sensitive credential data. An authenticated user with low privileges can read and modify stored social media credentials and configuration settings. This affects the confidentiality and integrity of connected social accounts.
What an attacker can do
03Attacker Capabilities
Read and modify stored social media credentials and plugin configuration settings.
Potential impact on your site
04Site Impact
Compromised social media accounts linked through the plugin; attacker can modify feeds or steal credentials.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
May 2, 2026
CVE published
May 4, 2026
Record updated
