The vulnerability is a missing authorization flaw in the WordPress Tiktok Feed plugin that permits attackers to exploit improperly configured access control levels. Because the plugin does not enforce proper permission checks, unauthorized users could access sensitive plugin data or perform actions reserved for privileged roles, potentially compromising confidentiality and integrity of content managed through the plugin.

This issue affects the WordPress Tiktok Feed plugin developed by bPlugins, impacting all released versions up to and including 1.0.24.

The CVSS score of 4.3 indicates a low severity issue, and the EPSS score is not available, suggesting limited evidence of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector could be remote via exposed plugin endpoints, potentially allowing an unauthenticated or minimally privileged user to bypass authorization checks. No specific exploit code is currently documented.