Threats tagged 'ghsa-6277-7m4g-vqm9'

The My Social Feeds – Social Feeds Embedder plugin for WordPress versions up to and including 1.0.4 has a vulnerability that allows authenticated users with Subscriber-level access or higher to retrieve sensitive TikTok OAuth credentials. This occurs due to missing authorization and nonce checks in the 'ttp_get_accounts' AJAX action, exposing access_token and refresh_token values of administrator-connected TikTok accounts.