CVE-2026-18346: CWE-862 Missing Authorization in tiktokbusinessplugin TikTok
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.
AI Analysis
Technical Summary
CVE-2026-18346 is an authorization bypass vulnerability (CWE-862) in the TikTok plugin for WordPress, affecting all versions up to and including 1.4.1. The plugin fails to properly verify user authorization before allowing actions that overwrite the merchant's stored TikTok integration access token in wp_options. An attacker who supplies a valid TikTok OAuth auth_code for the merchant's registered TikTok app can cause the plugin to exchange the token and overwrite the stored access token after receiving a successful 'OK' response from TikTok's API. This enables the attacker to hijack the TikTok Business and product catalog integration of the affected site.
Potential Impact
An attacker can overwrite the TikTok integration access token stored by the plugin, potentially hijacking the merchant's TikTok Business account and product catalog integration. This could disrupt the legitimate integration and allow unauthorized control over TikTok-related functionality on the site. There is no direct confidentiality or availability impact reported. Exploitation requires a valid TikTok OAuth auth_code, which limits the attacker's capabilities to those who can obtain such a code.
Mitigation Recommendations
No patch or official fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict access to the plugin and consider disabling it if possible. Ensure that TikTok OAuth credentials are protected and monitor for suspicious activity related to TikTok integrations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-18346: CWE-862 Missing Authorization in tiktokbusinessplugin TikTok
Description
The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite the merchant's stored TikTok integration access token in wp_options, hijacking the site's TikTok Business and product catalog integration. Successful exploitation requires the attacker to supply a valid TikTok OAuth auth_code issued for the merchant's registered TikTok app, as the plugin's token exchange must receive a message='OK' response from TikTok's API before the stored access token is overwritten.
CVSS v3.1
Score 5.3medium
Affected software
tiktokbusinessplugin
TikTok
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18346 is an authorization bypass vulnerability (CWE-862) in the TikTok plugin for WordPress, affecting all versions up to and including 1.4.1. The plugin fails to properly verify user authorization before allowing actions that overwrite the merchant's stored TikTok integration access token in wp_options. An attacker who supplies a valid TikTok OAuth auth_code for the merchant's registered TikTok app can cause the plugin to exchange the token and overwrite the stored access token after receiving a successful 'OK' response from TikTok's API. This enables the attacker to hijack the TikTok Business and product catalog integration of the affected site.
Potential Impact
An attacker can overwrite the TikTok integration access token stored by the plugin, potentially hijacking the merchant's TikTok Business account and product catalog integration. This could disrupt the legitimate integration and allow unauthorized control over TikTok-related functionality on the site. There is no direct confidentiality or availability impact reported. Exploitation requires a valid TikTok OAuth auth_code, which limits the attacker's capabilities to those who can obtain such a code.
Mitigation Recommendations
No patch or official fix is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restrict access to the plugin and consider disabling it if possible. Ensure that TikTok OAuth credentials are protected and monitor for suspicious activity related to TikTok integrations. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-29T22:33:17.256Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aae488655bf5e2cf553a3ff
Added to database: 09/19/2026, 08:32:06 UTC
Last enriched: 09/19/2026, 08:47:04 UTC
Last updated: 09/19/2026, 22:12:52 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.