The vulnerability identified as CVE-2025-66110 affects the bPlugins Tiktok Feed plugin up to version 1.0.23. It is caused by missing authorization checks, resulting in improperly configured access control. This allows unauthenticated attackers to perform actions that should require authorization, impacting the integrity of the system by enabling unauthorized modifications. The CVSS 3.1 base score is 5.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or official remediation guidance is currently available.

The primary impact is unauthorized modification of data within the affected plugin due to missing authorization controls. There is no reported impact on confidentiality or availability. No known exploits have been observed in the wild, indicating limited current exploitation activity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functionality or disabling it if possible to mitigate risk. Monitor vendor channels for updates regarding patches or official mitigations.