What the vulnerability does
01Description
The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain the site's Zoom SDK API key and a freshly-signed JWT that can be used with the Zoom Web SDK to join any Zoom meeting associated with those credentials without a legitimate invitation.
Explanation of Vulnerability in Simple Terms
02Summary
Video Conferencing with Zoom version 4.6.7 and earlier fails to properly check user permissions before allowing access to certain features. An attacker on the network can read sensitive information without authentication. Update to a version newer than 4.6.7.
What an attacker can do
03Attacker Capabilities
Read sensitive information without logging in.
Potential impact on your site
04Site Impact
Confidential data may be exposed to unauthenticated attackers on your network.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication required.
Key dates
06Disclosure timeline
June 16, 2026
CVE published
June 29, 2026
Record updated
