CVE-2026-24520

Vulnerability

The TikTok Feed plugin for WordPress (slug: b-tiktok-feed) from bPlugins contains a missing authorization vulnerability in versions from n/a through 1.0.24 [1]. The issue is a broken access control flaw, where certain functions lack proper authorization, authentication, or nonce token checks, allowing an unprivileged user to execute actions that should require higher privileges [1].

Exploitation

An attacker needs no special authentication; any unauthenticated or low-privileged user can exploit the missing access control checks to trigger the vulnerable functions. No specific sequence of steps is published, but the vulnerability is known to be used in mass-exploit campaigns against thousands of websites simultaneously [1]. The exploitation does not require user interaction or a race window.

Impact

Successful exploitation allows an attacker to perform unauthorized actions with elevated privileges, resulting in information disclosure, data modification, or other unintended operations depending on the affected function. The CVSS v3 score is 4.3 (Medium), with low severity impact on confidentiality and integrity [1].

Mitigation

The vendor released version 1.0.25 as the fixed version [1]. However, the plugin appears abandoned — no updates have been published since January 2026, and the last available release on WordPress.org remains 1.0.25 [2]. Users should update to 1.0.25 immediately if possible, or uninstall the plugin and replace it with an actively-maintained alternative [1][2]. Patchstack users can enable auto-updates for vulnerable plugins [1]. If updating is not possible, contact your hosting provider for assistance [1]. The CVE is not listed in KEV as of publication.