CVE-2026-6440: GoodMeet WordPress Plugin CSRF Vulnerability (v1.1.8)

Technical summary

CVE-2026-6440 is a Cross-Site Request Forgery (CSRF) vulnerability in the GoodMeet WordPress plugin affecting versions up to 1.1.8. The vulnerable code path is the reset_credential() function, which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action. While the function implements capability checks (verify_cap manage_options), it omits nonce validation—a standard WordPress security mechanism that prevents cross-origin requests from triggering privileged actions. An attacker crafts a malicious page containing a request to the vulnerable AJAX endpoint; when a logged-in administrator visits that page, the browser automatically submits the reset request with the admin's session cookies, causing the goodmeet_google_credentials and goodmeet_google_token options to be deleted. The attack requires user interaction (the admin must visit the attacker's page) and relies on social engineering to succeed.

Business impact

Disruption of video conferencing functionality is the primary business impact. Organizations using GoodMeet to host webinars or meetings will lose Google Meet integration until administrators manually reconfigure the plugin and re-authenticate with Google. This can disrupt scheduled events and erode user trust. The attack is not catastrophic—no customer data is stolen, and the attacker cannot access the site or user accounts—but it represents a denial-of-service vector against a collaboration feature. For enterprises heavily dependent on this integration, an opportunely timed attack during peak usage could cause operational friction.

Affected systems

WordPress sites running the GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin in version 1.1.8 or earlier are affected. The vulnerability is triggered only when an administrator visits a malicious link while logged into the WordPress dashboard, so exposure is limited to sites where administrators are the social engineering target. Sites that have already patched to version 1.1.9 or later (if such a patch exists) are not vulnerable.

Exploitability

The vulnerability is rated CVSS 4.3 (Medium severity) with straightforward but not immediate exploitability. An attacker must craft a malicious HTML page and socially engineer a site administrator to visit it while logged in. No special network access is required; the attack works over the public internet. The barrier to weaponization is low—only basic HTML and knowledge of the plugin's AJAX endpoint are needed. However, the attack depends on user interaction and administrative-level credentials, which limits its scope compared to unauthenticated remote code execution. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting it has not yet been weaponized in the wild at scale.

Remediation

Site administrators should update the GoodMeet plugin to the latest version that includes a nonce verification patch. Verify the specific patched version number in the official WordPress plugin directory or the vendor's advisory, as this data is version-sensitive. As an interim mitigation, administrators can disable or deactivate the plugin if the Google Meet integration is not currently critical; this eliminates the attack surface while a patch is validated. Additionally, enforce strong administrative access controls: use two-factor authentication (2FA) on WordPress admin accounts, limit who has manage_options capability, and educate administrators about phishing and malicious links.

Patch guidance

Check the WordPress plugin repository or the vendor's advisory for the patched version. Update the plugin via the WordPress admin dashboard (Plugins → Updates) once a safe version is confirmed. After patching, test the Google Meet integration to ensure credentials are still intact and the connection to Google's API is functional. If credentials were reset before patching, re-authenticate the plugin with Google following the setup wizard.

Detection guidance

Monitor WordPress audit logs and database change logs for unexpected deletions of the goodmeet_google_credentials and goodmeet_google_token options. Network-level detection is challenging since the attack uses legitimate AJAX calls and session cookies, but security teams can: (1) review wp-admin access logs for unusual referer headers pointing to external domains; (2) monitor for AJAX requests to wp-admin/admin-ajax.php?action=goodmeet_reset_google_meet_credential without a valid nonce parameter in POST data; (3) set up alerts if Google Meet integration credentials are cleared without an administrator manually initiating the reset. Use WordPress security plugins (e.g., Wordfence, iThemes Security) that offer CSRF detection and admin activity logging.

Why prioritize this

This vulnerability warrants prompt but not emergency-level attention. While CVSS 4.3 is moderate, the attack vector is human-centric and requires administrative interaction, reducing the risk to organizations with security-aware staff. However, any CSRF vulnerability that affects a plugin in active use should be patched in a timely manner, especially if the integration is business-critical. Prioritize patching if your organization relies on GoodMeet for scheduled webinars or if administrators handle sensitive communications via the integrated Google Meet. Defer less-critical site updates behind more severe vulnerabilities affecting remote code execution or data breach potential.

Risk score, explained

The CVSS 4.3 score reflects a low-impact confidentiality and integrity violation. The vulnerability has a network-based attack vector (AV:N) and low complexity (AC:L), making it easy to exploit in theory. However, it requires user interaction (UI:R)—the administrator must click a link—and only affects the availability of a feature, not the confidentiality of data or the core security of the WordPress installation. The scope is unchanged (S:U), meaning the impact is limited to the vulnerable plugin, not the wider system. Integrity is slightly impacted (I:L) because the attacker can modify the plugin's stored configuration, but confidentiality is not affected (C:N) and availability impact is low (A:N) since the site remains operational; only the Google Meet feature is disabled.

Frequently asked questions