CVE-2026-92965 TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption

The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code...