CVE-2026-39653

The Video Conferencing with Zoom plugin for WordPress, versions 4.6.6 and earlier, suffers from a missing authorization vulnerability. According to Patchstack, the issue allows exploitation of incorrectly configured access control security levels, specifically a missing authorization or nonce token check in a function [1].

An attacker with unprivileged access can exploit this flaw to execute higher-privileged actions. The vulnerability does not require authentication for exploitation; it can be triggered by any user who can interact with the plugin’s functionality [1].

The impact includes unauthorized access to sensitive features or data, potentially leading to further compromise of the WordPress site. While the vulnerability is rated as low severity with CVSS 4.3, Patchstack notes that such flaws are often used in mass exploit campaigns targeting thousands of sites [1].

Users are strongly advised to update the plugin to version 4.6.7 or later, which addresses the vulnerability. Patchstack recommends enabling auto-updates for vulnerable plugins to ensure timely protection [1].