CVE-2026-103335 Overview
CVE-2026-103335 is an information disclosure vulnerability in the Deepen Bajracharya Video Conferencing with Zoom WordPress plugin. The flaw affects all versions up to and including 4.6.10. It is classified under [CWE-201: Insertion of Sensitive Information Into Sent Data]. An authenticated attacker with low privileges can retrieve embedded sensitive data from responses generated by the plugin.
Critical Impact
Low-privileged users on affected WordPress sites can extract sensitive data embedded in plugin-generated responses, exposing Zoom integration secrets or related configuration information.
Affected Products
- Deepen Bajracharya Video Conferencing with Zoom plugin for WordPress
- All plugin versions from initial release through 4.6.10
- WordPress installations exposing the video-conferencing-with-zoom-api endpoints
Discovery Timeline
- 2026-10-05 - CVE-2026-103335 published to NVD
- 2026-10-06 - Last updated in NVD database
Technical Details for CVE-2026-103335
Vulnerability Analysis
The Video Conferencing with Zoom plugin integrates the Zoom API with WordPress to allow site operators to host and manage meetings. The vulnerability stems from the plugin embedding sensitive information inside data returned to users whose role should not grant visibility to that content. An authenticated attacker with low privileges can trigger the vulnerable code path and parse the response to recover secrets.
Because the attack vector is network-based and requires only low-level authentication, any site that permits subscriber-level account creation is reachable by remote actors. No user interaction is required. The impact is limited to confidentiality: integrity and availability are not affected.
Root Cause
The root cause is [CWE-201]: the plugin places sensitive information into outbound data without verifying that the recipient is authorized to see it. Typical patterns for this class of bug in WordPress plugins include returning API tokens, internal identifiers, or configuration values inside AJAX responses, REST endpoints, or rendered page markup accessible to authenticated users.
Attack Vector
An attacker authenticates to the WordPress site using any account with at least minimal privileges. The attacker then issues a request to a plugin endpoint provided by video-conferencing-with-zoom-api. The response contains sensitive fields that the plugin inserts without filtering based on the caller's role. The attacker extracts those fields from the response body for reuse or further attack staging.
No exploit code is publicly indexed for this CVE at the time of writing, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Patchstack Vulnerability Report for the advisory record.
Detection Methods for CVE-2026-103335
Indicators of Compromise
- Unexpected authenticated requests to plugin endpoints under /wp-admin/admin-ajax.php or REST routes exposed by video-conferencing-with-zoom-api.
- Low-privileged accounts repeatedly fetching plugin resources that return JSON payloads larger than typical UI calls.
- Outbound Zoom API activity originating from credentials or tokens that were previously only present in server-side configuration.
Detection Strategies
- Review WordPress access logs for subscriber or contributor accounts invoking Zoom plugin endpoints they would not normally use.
- Correlate authentication events with plugin-specific URIs to identify enumeration patterns against the video-conferencing-with-zoom-api namespace.
- Inspect response bodies in a staging environment to confirm which fields contain sensitive data before and after patching.
Monitoring Recommendations
- Enable verbose logging on the web server for authenticated plugin endpoints and ship logs to a centralized analytics platform.
- Alert on bulk retrieval of plugin AJAX or REST responses by newly created low-privilege accounts.
- Monitor Zoom API usage for credentials associated with the WordPress integration and rotate on anomaly.
How to Mitigate CVE-2026-103335
Immediate Actions Required
- Identify all WordPress sites running the Video Conferencing with Zoom plugin and record the installed version.
- Restrict account self-registration until the plugin is updated to a fixed release.
- Rotate any Zoom API credentials, JWTs, or OAuth secrets that may have been embedded in plugin responses.
Patch Information
At the time of publication, the Patchstack advisory lists all versions through 4.6.10 as affected. Administrators should upgrade to the latest release provided by the plugin maintainer that addresses CVE-2026-103335 and consult the Patchstack Vulnerability Report for fixed version details.
Workarounds
- Deactivate the Video Conferencing with Zoom plugin until a patched version can be installed.
- Place the WordPress admin and AJAX endpoints behind a web application firewall that filters requests to video-conferencing-with-zoom-api routes.
- Audit user roles and remove unnecessary low-privilege accounts that could be leveraged to reach the vulnerable endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
