Technical impact
The vulnerability resides in the Video Conferencing with Zoom WordPress plugin before version 4.6.6. An AJAX handler used to generate Zoom SDK signatures has its nonce verification commented out, permitting unauthenticated attackers to craft valid signatures for any meeting ID and to retrieve the site's Zoom SDK key. This authentication bypass allows an attacker to create or join Zoom meetings as a host or participant without authorization and to expose confidential SDK keys that could be reused for further attacks.
Affected Systems
The affected product is the WordPress plugin Video Conferencing with Zoom, all releases prior to version 4.6.6. No specific vendor name is identified beyond the plugin; the vulnerability applies to any site running the affected plugin version.
Risk and Exploitability
The CVSS score is 7.5, indicating high severity. EPSS score is 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote unauthenticated web request to the exposed AJAX endpoint, which can be triggered via a simple HTTP call. An attacker only needs the meeting ID and has no authentication credentials, making exploitation straightforward. If successful, the attacker could gain the Zoom SDK key and generate valid meeting invitations, potentially undermining confidentiality, integrity, and availability of the host and participants.
