CVE-2026-6964: WordPress Zoom Plugin Auth Bypass Flaw

CVE-2026-6964 Overview

The Video Conferencing with Zoom plugin for WordPress contains an authorization bypass vulnerability affecting all versions up to and including 4.6.7. The plugin fails to verify that a requesting user is authorized to perform sensitive actions. Unauthenticated attackers can retrieve the site's Zoom SDK API key along with a freshly-signed JSON Web Token (JWT). These credentials allow an attacker to join any Zoom meeting associated with the site through the Zoom Web SDK without a legitimate invitation. The flaw is categorized as Missing Authorization [CWE-862] and is exploitable remotely over the network without user interaction.

Critical Impact
Unauthenticated attackers can extract Zoom SDK credentials and a signed JWT, enabling unauthorized access to any Zoom meeting tied to the affected WordPress site.

Affected Products

Video Conferencing with Zoom plugin for WordPress, all versions through 4.6.7
WordPress sites using the video-conferencing-with-zoom-api plugin
Any Zoom meeting tied to the site's configured Zoom SDK credentials

Discovery Timeline

2026-06-16 - CVE-2026-6964 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-6964

Vulnerability Analysis

The vulnerability is an authorization bypass in the Video Conferencing with Zoom plugin for WordPress. The plugin exposes functionality that returns the configured Zoom SDK API key and generates a signed JWT for use with the Zoom Web SDK. The handler does not enforce a capability or authentication check before issuing these credentials. As a result, any unauthenticated remote requester can obtain working session material. Once an attacker holds a valid SDK key and JWT, they can join arbitrary Zoom meetings hosted under the site's Zoom account through the Web SDK. The flaw originates in the plugin's AJAX handler defined in class-zvc-admin-ajax.php and a related routine in template-functions.php. The impact is information disclosure of credentials and unauthorized session participation, including potential eavesdropping on confidential discussions.

Root Cause

The root cause is missing authorization [CWE-862] in the plugin's request handlers. The code paths that mint and return the SDK key and JWT do not validate that the caller has the required capability or even an authenticated session. The plugin treats credential issuance as a public operation, which is incorrect given the sensitivity of the returned material.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the exposed plugin endpoint on a vulnerable WordPress site. The server responds with the Zoom SDK API key and a freshly signed JWT. The attacker then loads the Zoom Web SDK with these credentials and joins any meeting associated with the site's Zoom configuration. No phishing, social engineering, or invitation flow is required. See the Wordfence Vulnerability Report and the affected plugin source in class-zvc-admin-ajax.php for technical details.

Detection Methods for CVE-2026-6964

Indicators of Compromise

Unauthenticated POST or GET requests to the plugin's admin-ajax.php action used to issue Zoom SDK credentials
Outbound responses containing Zoom SDK API key material or JWT strings issued to unauthenticated sessions
Unexpected Zoom meeting participants joining via the Web SDK without a corresponding invitation record
Web server access logs showing repeated requests to plugin endpoints under /wp-content/plugins/video-conferencing-with-zoom-api/

Detection Strategies

Inspect WordPress access logs for unauthenticated calls to AJAX actions registered by the plugin and correlate response sizes with JWT-like payloads.
Audit the WordPress plugin inventory and flag any installation of video-conferencing-with-zoom-api at version 4.6.7 or earlier.
Review Zoom meeting participant logs for joins originating from Web SDK sessions that do not match invited attendees.

Monitoring Recommendations

Enable web application firewall (WAF) logging for all requests to the plugin's AJAX endpoints and alert on anonymous access.
Monitor Zoom account audit logs for unusual JWT issuance patterns or unexpected meeting joins.
Track WordPress plugin versions across the estate and alert on installs still running vulnerable releases.

How to Mitigate CVE-2026-6964

Immediate Actions Required

Update the Video Conferencing with Zoom plugin to a version newer than 4.6.7 as soon as a fixed release is available from the vendor.
If no patched version is available, deactivate and remove the plugin from all affected WordPress sites.
Rotate the Zoom SDK API key and secret used by the plugin, since unauthenticated attackers may have already retrieved them.
Review Zoom meeting logs for unauthorized participants and reset meeting passcodes and waiting room policies.

Patch Information

The vulnerability affects all versions up to and including 4.6.7. Refer to the WordPress Plugin Change Log and the Wordfence Vulnerability Report for the latest fix status and upgrade guidance.

Workarounds

Block public access to the plugin's AJAX endpoints at the WAF or reverse proxy layer until a patch is applied.
Restrict Zoom meeting access using waiting rooms, registration requirements, and unique passcodes to limit the impact of leaked SDK credentials.
Enforce the principle of least privilege on the Zoom account tied to the plugin and use a dedicated SDK app with minimal meeting scope.

bash

# Example WAF rule pattern to block unauthenticated access to the vulnerable endpoint
# Adjust action name to the specific AJAX action used by the plugin
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026964,msg:'Block unauth Zoom plugin SDK key issuance'"
  SecRule ARGS:action "@rx ^(zoom_.*sdk|get_signature|generate_signature)$" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"