WordPress Video Conferencing with Zoom Missing Auth to SDK Credential Exposure CVE-2026-6964

Vulnerability Overview Vulnerability Name: Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action CVE ID: CVE-2026-6964 CVSS Score: 5.3 (Medium) Published Date: June 15, 2026 Last Updated: June 16, 2026 Researcher: aetta Affected Software Software Type: Plugin Software Name: Video Conferencing with Zoom Affected Versions: <= 4.6.7 Fixed Version: 4.6.8 Remediation Fix Status: Fixed Fixed Version: 4.6.8 or later Vulnerability Description The Video Conferencing with Zoom plugin contains an authorization bypass vulnerability affecting all versions up to 4.6.7. This vulnerability allows unauthenticated attackers to retrieve the site's Zoom SDK API key and JWT token, enabling them to join any Zoom meeting associated with these credentials via the Zoom Web SDK without a legitimate invitation. References plugins.trac.wordpress.org Additional Information Sharing Options: Facebook, Twitter, LinkedIn, Email Recent Related Vulnerabilities CVE-2026-1368: Video Conferencing with Zoom <= 4.6.6 - Missing Authorization CVE-2026-39653: Video Conferencing with Zoom <= 4.6.6 - Missing Authorization CVE-2024-35584: Video Conferencing with Zoom <= 4.4.4 - Open Redirect CVE-2024-2033: Video Conferencing with Zoom <= 4.4.5 - Sensitive Information Exposure CVE-2024-2031: Video Conferencing with Zoom <= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-3947: Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure CVE-2022-4578: Video Conferencing with Zoom <= 4.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2022-0384: Video Conferencing with Zoom <= 3.9.2 - Reflected Cross-Site Scripting CVE-2022-0384: Video Conferencing with Zoom <= 3.8.16 - E-mail Address Disclosure CVE-2022-0384: Video Conferencing with Zoom <= 3.8.16 - Reflected Cross-Site Scripting Disclaimer This record contains copyrighted material; specific copyright information is available at the bottom of the page. Contact For additions or corrections, please contact: info@support@wordfence.com Other Services Wordfence Intelligence: Offers free and commercial access to the WordPress vulnerability database, supporting webhook integration. Wordfence Plugin: Instantly notifies WordPress sites of affected vulnerabilities upon installation. Footer Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days/year, 1-hour response time Legal Terms Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Data Sales: Do Not Sell or Share My Personal Information Social Media Facebook: Link Twitter: Link LinkedIn: Link Instagram: Link Products and Services Wordfence Free: Link Wordfence Premium: Link Wordfence Care: Link Wordfence Response: Link Wordfence CLI: Link Wordfence Intelligence: Link Wordfence Central: Link Support Documentation: Link Learning Center: Link Free Support: Link Advanced Support: Link News Blog: Link Latest Updates: Link Vulnerability Advisories: Link About About Wordfence: Link Affiliate Program: Link Careers: Link Contact: Link Security: Link CVE Request Form: Link Subscribe for Updates Subscribe: Link Copyright Information © 2012-2026 Defend Inc. All Rights Reserved Other Wordfence Intelligence: Link Disclaimer Disclaimer: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Other: Link Other Oth

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Video Conferencing with Zoom Missing Auth to SDK Credential Exposure CVE-2026-6964

More from this source