The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Video Conferencing With Zoom Api Plugin | — | Update video-conferencing-with-zoom-api plugin to version 4.6.6, or a newer patched version | Feb 25, 2026 | Feb 19, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub