CVE-2026-1368

HIGH

7.5

Descripcion

The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado2/18/2026

Ultima modificacion2/18/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-287

Referencias

https://wpscan.com/vulnerability/218e6655-c5aa-4bce-86b2-cad3bb20020c/(contact@wpscan.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.