What’s Vulnerable › Vulnerabilities
CVE-2026-92965: TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-20 · updated 2026-09-22
- Weakness: CWE-862
Description
The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.
Affected products
- TikTok: from 1.2.0 before 1.4.2 — fixed in 1.4.2
How to fix
Upgrade to a fixed version: TikTok 1.4.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-92965 or the next vulnerability affects your stack