CVE-2026-92965: Missing Authorization

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...

PT-2026-95932

Name of the Vulnerable Software and Affected Versions TikTok WordPress plugin versions prior to 1.4.2 Description An issue exists where the plugin fails to verify if a request is authorized before processing a sign-in code provided in the URL. This allows any visitor to force the site to redeem a...