Security Alert Summary
The Video Conferencing with Zoom plugin contains an AJAX handler where nonce verification has been commented out. This allows unauthenticated attackers to generate valid Zoom SDK signatures for arbitrary meeting IDs and to retrieve the site’s Zoom SDK key, exposing sensitive information used for Zoom integrations.
CVE Details
- CVE ID:
CVE-2026-1368 - Affected component: Video Conferencing with Zoom WordPress plugin
- Affected versions: versions before 4.6.6 (as stated in the CVE entry)
- Published: February 18, 2026 at 6:16:34 AM (UTC)
- Last modified: February 18, 2026 at 2:16:05 PM (UTC)
- CVSS v3.1: Base Score 7.5, Severity: HIGH; Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication / Privileges / User interaction: No authentication required; privileges required: none; user interaction: none
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- CWE / weakness: CWE-287 (as listed in the CVE entry)
Technical Details
The CVE description indicates that an AJAX handler in the plugin has its nonce verification commented out. Because the nonce check is not enforced, unauthenticated requests can successfully call the handler. The missing nonce validation allows an attacker to generate valid Zoom SDK signatures for any meeting ID and to retrieve the site’s Zoom SDK key from the plugin’s functionality.
This vulnerability exists due to the absence of the intended server-side request validation (nonce verification) in the AJAX endpoint. The direct consequences described in the CVE are disclosure of the Zoom SDK key and generation of SDK signatures; the entry does not provide additional implementation details such as specific function names beyond referring to the AJAX handler or indicate other affected endpoints.
How This Could Impact Your Website
In a realistic scenario, a site owner runs the Video Conferencing with Zoom plugin and several staff members (editors, contributors) schedule or host meetings. An external attacker could use the vulnerable AJAX handler to obtain the site’s Zoom SDK key and generate valid signatures for meeting IDs. This can expose integration credentials and enable the attacker to create or manipulate client-side Zoom sessions that rely on the compromised credentials.
Practical consequences include disclosure of internal integration keys or meeting identifiers and an increased risk of targeted phishing or social engineering against staff or contractors who participate in Zoom meetings. The CVSS impact is primarily confidentiality-related; it does not indicate integrity or availability loss in this entry.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the CVE entry only specifies affected versions as “before 4.6.6”).
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles that can interact with integrations.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and logs for unusual behavior related to AJAX endpoints or unexpected requests for integration keys.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
