CVE-2026-24520

MediumCVSS 4.3

Published: 26/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The Tiktok Feed plugin for WordPress up to version 1.0.24 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker can gain unauthorized access to administrative functions or data, potentially leading to privilege escalation.

Recommendation

Update the Tiktok Feed plugin to the latest version and implement proper access controls.

Other vulnerabilities in Tiktok Feed

CVE-2025-66110Medium
The bPlugins Tiktok Feed WordPress plugin in versions up to and including 1.0.23 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Missing Authorization vulnerability in bPlugins Tiktok Feed allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Tiktok Feed: from n/a through 1.0.24.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS