CVE-2025-66110
WordPress vulnerability analysis and mitigation

Overview

CVE-2025-66110 is a Missing Authorization vulnerability in the bPlugins TikTok Feed WordPress plugin (slug: b-tiktok-feed) that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects all versions of the plugin through 1.0.23 (some sources cite through 1.0.22). The vulnerability was published on November 21, 2025, and was reported by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

Technical details

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing certain actions or exposing functionality. This allows network-based attackers with no authentication, no user interaction, and low attack complexity to interact with restricted plugin functionality. The vulnerability falls under the broader category of Broken Access Control, where plugin endpoints or AJAX handlers lack capability checks or nonce verification (Feedly).

Impact

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, meaning an unauthenticated attacker can perform unauthorized data modifications or trigger restricted plugin actions on affected WordPress sites. The scope is unchanged, limiting the impact to the vulnerable plugin's own context. While not a critical-severity issue, it could allow attackers to manipulate TikTok feed settings or plugin data without proper authorization (Feedly).

Exploitability

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-66110. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Mitigation and workarounds

Users should update the bPlugins TikTok Feed WordPress plugin to a version beyond 1.0.23 that includes proper authorization checks. If an updated version is not yet available, site administrators should consider deactivating the plugin until a patch is released. Restricting access to WordPress admin and plugin endpoints via web application firewall (WAF) rules can serve as an interim mitigation (Feedly, Patchstack).

Additional resources


SourceThis report was generated using AI

Related WordPress vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-77115HIGH7.1
  • brave-popup-builder
NoYesAug 23, 2026
CVE-2026-77116MEDIUM4.3
  • brave-popup-builder
NoYesAug 23, 2026
CVE-2026-14853MEDIUM4.3
  • woocommerce-bookings
NoYesAug 23, 2026
CVE-2026-77003LOW2.7
  • content-mask
NoYesAug 23, 2026
CVE-2026-13598NONEN/A
  • restrictmate
NoYesAug 23, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management