This vulnerability in bPlugins Tiktok Feed arises from missing authorization controls, classified under CWE-862. It affects versions through 1.0.24 and enables attackers with some privileges (low privileges required) to perform unauthorized actions due to improper access control configuration. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official remediation guidance is currently available.

The vulnerability allows an attacker with low privileges to perform unauthorized actions that could affect the integrity of the system or data managed by the Tiktok Feed plugin. There is no impact on confidentiality or availability. No known exploits have been reported in the wild, limiting immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and tighten access control configurations for the Tiktok Feed plugin to limit potential unauthorized actions. Monitor for vendor updates regarding patches or official mitigations.