Skip to content
Sign in
7.5 High

CVE-2026-1368 The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce…

Description

The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.

Affected products and versions

Product Affected versions Fixed in
Video Conferencing with Zoom 4.6 earliest → < 4.6.6 4.6.6

Other CVEs of Video Conferencing with Zoom

The 3 CVEs of Video Conferencing with Zoom →
CVE-2022-4578 The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode… 5.4 Medium CVE-2022-0384 The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users… Not rated
Track this CVE