CVE-2026-6446 — The My Social Feeds – Social Feeds Embedder plugin for

title: CVE-2026-6446 - My Social Feeds Plugin Unauthorized Access to TikTok Credentials
id: scw-2026-05-02-ai-1
status: experimental
level: critical
description: |
  Detects the specific AJAX action 'ttp_get_accounts' called on 'admin-ajax.php' by the My Social Feeds plugin. This action is vulnerable in CVE-2026-6446 due to missing authorization checks, allowing authenticated users (even subscribers) to retrieve sensitive TikTok OAuth credentials (access_token, refresh_token) from the 'ttp_tiktok_accounts' option. This is the primary indicator of exploitation for this vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-02
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6446/
tags:
  - attack.privilege_escalation
  - attack.t1078.004
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/wp-admin/admin-ajax.php'
      cs-uri-query|contains:
          - 'action=ttp_get_accounts'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse