My Social Feeds <= 1.0.4 — Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under My Social Feeds – bring your social content into WordPress.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 1.0.5, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch My Social Feeds – bring your social content into WordPress to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Teerachai Somprasong.

The My Social Feeds – Social Feeds Embedder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 1.0.4 via the 'ttp_get_accounts' AJAX action. This is due to the complete absence of authorization checks (no capability verification) and nonce verification in the get_accounts() function, which returns the full contents of the 'ttp_tiktok_accounts' WordPress option. This makes it possible for authenticated attackers, with Subscriber-level access and above, to retrieve sensitive TikTok OAuth credentials, including access_token and refresh_token values, that belong to administrator-connected TikTok accounts, enabling them to impersonate the site owner when interacting with the TikTok API.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Timeline

1. May 1, 2026

   CVE published

   Severity medium, CVSS 5.4

2. Nov 13, 2026

   Record last updated