The WordPress Video Conferencing with Zoom plugin is missing proper authorization checks on the AJAX action that retrieves Zoom SDK credentials. Una‑uthenticated callers can invoke this endpoint and receive the site's Zoom SDK API key and a freshly‑signed JWT, enabling them to join any Zoom meeting associated with those credentials without an invitation. The weakness is a classic missing authorization flaw (CWE-862).

All versions of the Video Conferencing with Zoom plugin up to and including 4.6.7 are affected. Users who have deployed these releases on WordPress sites are vulnerable until the flaw is remediated by an updated plugin version.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of < 1% suggests that known exploitation activity is rare, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is unauthenticated and requires only a simple HTTP GET/POST request to the public AJAX endpoint, making the exploit relatively easy to carry out if a site has not been patched.