CVE-2026-92965 TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-92965?
CVE-2026-92965 is a low-severity vulnerability in Unknown TikTok, published on 20 Sep 2026.
Official description
The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can make the site redeem a code of their choosing against the advertising platform, using the site's own credentials. It matches that code loosely, so URLs that merely resemble the expected one trigger it too, and the callback runs on every request to the site rather than only on the administrator's sign-in.
Weakness: CWE-862
Which versions are affected by CVE-2026-92965?
How do I fix CVE-2026-92965?
No fix has been published for CVE-2026-92965 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92965 being exploited?
There is no known exploitation of CVE-2026-92965 in the wild and no public exploit code.
Sources
Also known as GHSA-774v-j88v-3m84.