CVE-2026-6964

Vulnerability

The Video Conferencing with Zoom plugin for WordPress versions up to and including 4.6.7 contains an authorization bypass vulnerability in the AJAX handlers. The plugin does not properly verify that a user is authorized to perform actions that expose sensitive credentials. Specifically, the vczapi_state and mtg_data localizations in template-functions.php [1][2][3] and the AJAX endpoints in class-zvc-admin-ajax.php [4] lack proper capability checks, allowing unauthenticated access to the site's Zoom SDK API key and a freshly-signed JWT.

Exploitation

An unauthenticated attacker can send crafted requests to the WordPress AJAX endpoints without any authentication or user interaction. By exploiting the missing authorization checks, the attacker retrieves the Zoom SDK API key and a JWT token that is valid for the Zoom Web SDK. The attacker does not need any special network position beyond being able to reach the WordPress site.

Impact

Successful exploitation enables the attacker to use the obtained Zoom SDK API key and JWT to join any Zoom meeting associated with the site's Zoom credentials without a legitimate invitation. This leads to unauthorized access to Zoom meetings, potentially exposing confidential discussions and meeting content. The attacker gains the ability to participate in meetings as if they were an authorized attendee.

Mitigation

The vendor has not yet released a patched version as of the publication date. Users should update to a fixed version once available. As a workaround, administrators can restrict access to the AJAX endpoints via web application firewall rules or disable the plugin until a patch is released. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog at this time.