PT-2026-36567 · WordPress · My Social Feeds

Teerachai Somprasong · Published 2026-05-02 · Updated 2026-05-02 · CVE-2026-6446

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions My Social Feeds – Social Feeds Embedder versions prior to 1.0.5

Description The plugin is subject to sensitive information exposure via the 'ttp get accounts' AJAX action. The get accounts() function lacks authorization checks and nonce verification, allowing authenticated attackers with Subscriber-level access or higher to retrieve the full contents of the ttp tiktok accounts WordPress option. This includes sensitive TikTok OAuth credentials, specifically access token and refresh token values from administrator-connected accounts, which can be used to impersonate the site owner when interacting with the TikTok API.

Recommendations Update the plugin to a version later than 1.0.4. As a temporary workaround, restrict access to the 'ttp get accounts' AJAX action to prevent unauthorized users from calling the get accounts() function.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2026-6446

Affected Products

My Social Feeds

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-6446 · Security Note
• https://plugins.trac.wordpress.org/browser/my-social-feeds/tags/1.0.2/includes/TiktokAPI.php#L24 · Note
• https://twitter.com/VulmonFeeds/status/2050453545606856739 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d46d6493-8b89-4258-9d83-79e5946cd76f?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3514796%40my-social-feeds&new=3514796%40my-social-feeds&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/my-social-feeds/trunk/includes/TiktokAPI.php#L24 · Note
• https://plugins.trac.wordpress.org/browser/my-social-feeds/trunk/includes/TiktokAPI.php#L190 · Note
• https://plugins.trac.wordpress.org/browser/my-social-feeds/tags/1.0.2/includes/TiktokAPI.php#L190 · Note