CVE-2025-66110

MediumCVSS 5.3

Published: 21/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The bPlugins Tiktok Feed WordPress plugin in versions up to and including 1.0.23 contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

Risk Assessment

An unauthorized user may perform actions gated by access control, potentially leading to unauthorized changes on the site. The risk affects WordPress sites with the vulnerable plugin installed.

Recommendation

Update the Tiktok Feed plugin to a version later than 1.0.23. Review and correct the plugin's permission configuration.

Other vulnerabilities in Tiktok Feed

CVE-2026-24520Medium
The Tiktok Feed plugin for WordPress up to version 1.0.24 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.

Original NVD description (English source)

Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tiktok Feed: from n/a through <= 1.0.23.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS