The vulnerability in the My Social Feeds WordPress plugin allows authorized users with Subscriber-level access or higher to retrieve the full contents of the 'ttp_tiktok_accounts' WordPress option. The plugin performs no capability or nonce checks when the 'ttp_get_accounts' AJAX action is invoked, exposing TikTok OAuth credentials such as access_token and refresh_token. An attacker who can obtain these credentials can impersonate the site owner when interacting with the TikTok API, compromising the confidentiality of authentication information and potentially enabling unauthorized use of the site’s TikTok integration. This weakness is classified under CWE‑522, Sensitive Information Exposure.

The affected product is the My Social Feeds – Social Feeds Embedder plugin for WordPress, distributed by bplugins. All plugin versions up to and including 1.0.4 are vulnerable, as the flawed 'ttp_get_accounts' function exists in those releases.

The CVSS score of 5.4 indicates a medium severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploitation in the wild. However, the attack requires only that the user be authenticated with at least Subscriber privileges, which are commonly granted in WordPress sites. A successful exploit would involve an authenticated attacker sending the affected AJAX request to retrieve OAuth credentials, leading to potential impersonation of the site owner. Due to the absence of public exploitation evidence, the immediate risk is moderate, but the possibility of credential theft remains significant.