CVE-2026-6440: GoodMeet WordPress Plugin CSRF Vulnerability

CVE-2026-6440 Overview

CVE-2026-6440 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress. The flaw exists in versions up to and including 1.1.8. The reset_credential() function, which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action, is missing nonce verification. While the function verifies the manage_options capability, it does not validate a nonce token. Unauthenticated attackers can trick a site administrator into clicking a crafted link that resets stored Google Meet API credentials and OAuth tokens, disabling the integration. The issue is categorized under CWE-352.

Critical Impact
Successful exploitation deletes the plugin's goodmeet_google_credentials and goodmeet_google_token values, breaking Google Meet integration across the affected WordPress site.

Affected Products

GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress
All versions up to and including 1.1.8
WordPress sites where an administrator with manage_options can be socially engineered into visiting a malicious page

Discovery Timeline

2026-07-10 - CVE-2026-6440 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-6440

Vulnerability Analysis

The vulnerability resides in the reset_credential() function within Goodmeet_Ajax.php, registered against the wp_ajax_goodmeet_reset_google_meet_credential AJAX action. The handler performs a capability check for manage_options but does not call check_ajax_referer() or wp_verify_nonce() before executing the destructive action. Because WordPress authenticates AJAX requests through session cookies, any authenticated administrator browsing to attacker-controlled content will silently issue the request. This is the classic pattern behind CSRF weaknesses tracked under [CWE-352]. Exploitation requires user interaction from an authenticated administrator, but no attacker credentials on the target site. The impact is limited to integrity: the plugin's stored Google Meet API credentials and OAuth tokens are deleted, disabling scheduled meetings and webinar workflows until an administrator re-authenticates against Google.

Root Cause

The root cause is missing anti-CSRF token validation in a state-changing AJAX endpoint. WordPress documentation requires nonce verification for any action that modifies server state. The plugin author enforced only role authorization, treating the capability check as sufficient. Capability checks confirm who the request runs as, not whether the user intended to send it.

Attack Vector

An attacker hosts a page containing an image tag, form auto-submit, or fetch() call targeting /wp-admin/admin-ajax.php with the action goodmeet_reset_google_meet_credential. When a logged-in WordPress administrator loads the malicious page, the browser attaches the WordPress session cookie, and the plugin executes the reset. No prior authentication to the target site is needed by the attacker.

For the underlying vulnerable code path, see the WordPress plugin source for Goodmeet_Ajax.php and the reset logic in Goodmeet_Meet.php.

Detection Methods for CVE-2026-6440

Indicators of Compromise

Unexpected clearing of the goodmeet_google_credentials and goodmeet_google_token options in the WordPress wp_options table.
HTTP POST requests to /wp-admin/admin-ajax.php with the parameter action=goodmeet_reset_google_meet_credential originating from external Referer headers.
Administrator sessions issuing the reset action without a corresponding visit to the plugin's settings page in the same session.

Detection Strategies

Review web server access logs for POST requests to admin-ajax.php where the action parameter matches goodmeet_reset_google_meet_credential and cross-check the Referer header against trusted origins.
Enable WordPress audit logging to capture option deletions or overwrites for goodmeet_google_credentials and goodmeet_google_token.
Baseline the frequency of Google Meet integration resets and alert on anomalies for administrator accounts.

Monitoring Recommendations

Forward WordPress and web server logs to a centralized SIEM and alert on the AJAX action string above.
Monitor administrator user-agent and IP patterns for AJAX endpoints that modify integration settings.
Track re-authentication events with Google OAuth to correlate legitimate resets against unauthorized ones.

How to Mitigate CVE-2026-6440

Immediate Actions Required

Update the GoodMeet plugin to a version later than 1.1.8 once the vendor publishes a patched release.
Instruct WordPress administrators not to remain logged in while browsing untrusted sites and to use dedicated browser profiles for admin sessions.
Audit stored Google Meet credentials and re-authenticate the integration if unexpected resets are observed.

Patch Information

Refer to the WordPress plugin changeset and the Wordfence advisory for the fixed version and remediation details. The corrected code adds nonce verification to the reset_credential() handler before performing any state changes.

Workarounds

Deploy a Web Application Firewall (WAF) rule blocking POST requests to admin-ajax.php where action=goodmeet_reset_google_meet_credential and the Referer header is missing or does not match the site origin.
Temporarily deactivate the GoodMeet plugin on sites where administrators cannot immediately update.
Enforce SameSite=Strict or SameSite=Lax on WordPress authentication cookies to reduce cross-site request delivery.

bash

# Example ModSecurity rule blocking cross-origin CSRF against the vulnerable action
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026440,\
   msg:'CVE-2026-6440 GoodMeet CSRF attempt blocked'"
  SecRule ARGS:action "@streq goodmeet_reset_google_meet_credential" \
    "chain"
    SecRule &REQUEST_HEADERS:Referer "@eq 0"