CVE-2026-1368

—

CVSS 3.1

7.5 high

EPSS

1%p67

Published

Feb 18, 2026 (Feb 18, 2026)

Modified

Jun 17, 2026

Description

The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.

Ecosystems: WordPress
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news0 stories

No ingested article mentions this CVE yet.