CVE-2026-6964
Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain the site's Zoom SDK API key and a freshly-signed JWT that can be used with the Zoom Web SDK to join any Zoom meeting associated with those credentials without a legitimate invitation.
| CWE | CWE-862 |
| Vendor | j_3rk |
| Product | video conferencing with zoom |
| Published | Jun 16, 2026 |
| Last Updated | Jun 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for j_3rk video conferencing with zoom
Be the first to know when new medium vulnerabilities affecting j_3rk video conferencing with zoom are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
j_3rk / Video Conferencing with Zoom
0 ≤ 4.6.7
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/328a4d88-afa2-4305-a8e5-73e626e9f53f?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/trunk/includes/admin/class-zvc-admin-ajax.php#L183 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/tags/4.6.7/includes/admin/class-zvc-admin-ajax.php#L183 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/trunk/includes/template-functions.php#L558 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/tags/4.6.7/includes/template-functions.php#L558 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/tags/4.6.6/includes/admin/class-zvc-admin-ajax.php#L183 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/tags/4.6.6/includes/template-functions.php#L558 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3565576%40video-conferencing-with-zoom-api&new=3565576%40video-conferencing-with-zoom-api&sfp_email=&sfph_mail=
Credits
andre chiape