Junglewise Threat Intelligence

CVE-2026-6964: WordPress Video Conferencing with Zoom authorization bypass

CVE-2026-6964 · Severity: medium · CVSS 5.3 · Published 2026-06-16

Executive brief

The Video Conferencing with Zoom plugin for WordPress, which integrates Zoom meetings into websites, contains a security flaw that allows unauthorized individuals to access sensitive credentials. An attacker can exploit this to obtain the site's Zoom API key and a valid security token. This would allow them to join any Zoom meeting associated with the site's account without needing a legitimate invitation or password.

Technical details

The Video Conferencing with Zoom plugin for WordPress is vulnerable to a missing authorization check (CWE-862) in versions up to and including 4.6.7. The vulnerability exists within the plugin's AJAX handling and template functions, where it fails to properly verify user permissions before performing sensitive actions. An unauthenticated remote attacker can exploit this flaw to retrieve the site's Zoom SDK API key and a freshly-signed JSON Web Token (JWT). These credentials can then be used with the Zoom Web SDK to join any Zoom meeting associated with the compromised account without a legitimate invitation. A patch has been released in subsequent versions.

Affected products

  • Deepak Rayamajhi Video Conferencing with Zoom Up to and including 4.6.7

Timeline

  • 2026-06-16: disclosed
  • 2026-06-16: advisory

References