What the vulnerability does
01Description
The GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.8. This is due to a missing nonce verification in the reset_credential() function, which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action. While the function does verify the user's capability (manage_options), it does not validate a nonce, making it susceptible to CSRF attacks. This makes it possible for unauthenticated attackers to trick a site administrator into clicking a malicious link that will reset (delete) the plugin's stored Google Meet API credentials (goodmeet_google_credentials) and OAuth tokens (goodmeet_google_token), effectively disabling the Google Meet integration on the site.
Explanation of Vulnerability in Simple Terms
02Summary
GoodMeet versions up to 1.1.8 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unwanted actions on behalf of authenticated users. An attacker can craft a malicious link or page that, when visited by a logged-in site administrator or user, executes unauthorized requests without their knowledge. The vulnerability requires user interaction but can modify site data or settings.
What an attacker can do
03Attacker Capabilities
Perform unauthorized actions on the site by tricking a logged-in user into visiting a malicious page.
Potential impact on your site
04Site Impact
Site settings or data could be modified without your knowledge if an admin visits a compromised page.
Conditions required to exploit
05Prerequisites
A logged-in user must visit an attacker-controlled page or click a malicious link while authenticated.
Key dates
06Disclosure timeline
July 10, 2026
CVE published
