CVE-2026-6964: Zoom WordPress Plugin Authorization Bypass Lets Unauthenticated Attackers Join Meetings

Technical summary

CVE-2026-6964 is an authorization bypass vulnerability (CWE-862) in the Video Conferencing with Zoom WordPress plugin. The plugin fails to enforce proper authorization checks before exposing the Zoom SDK API key and issuing JWT tokens. This allows unauthenticated attackers to extract credentials and forge authenticated sessions with the Zoom Web SDK. The vulnerability has a CVSS v3.1 score of 5.3 (MEDIUM) with a network attack vector, low complexity, no privilege requirement, and no user interaction needed. The impact is limited to confidentiality (disclosure of the API key and JWT); integrity and availability are not affected.

Business impact

Organizations using this plugin face credential exposure and unauthorized meeting access. An attacker could systematically join sensitive meetings—investor calls, board meetings, personnel discussions, client confidential sessions—without detection. While the CVSS score is moderate, the business risk is amplified by the nature of video conferencing: meetings often contain proprietary information, strategic decisions, and personal data. The ease of exploitation (no authentication, no interaction required) compounds the risk. Affected organizations should prioritize understanding which Zoom meetings have been joined by unauthorized parties and review meeting recordings and transcripts for potential data leakage.

Affected systems

Any WordPress site running the Video Conferencing with Zoom plugin in versions 4.6.7 or earlier is vulnerable. The plugin's popularity and ease of installation suggest potentially thousands of WordPress deployments are at risk. The vulnerability is not limited to a specific WordPress version or configuration; the flaw lies in the plugin itself.

Exploitability

This vulnerability is highly exploitable. An attacker requires no credentials, no special tools beyond a web browser, and can exploit it with a simple unauthenticated HTTP request to the plugin's endpoint. The lack of user interaction and network-only attack surface means exploitation can be automated and weaponized at scale. No active CVE-2026-6964 exploitation activity has been publicly reported as of the vulnerability publication date, but the low barrier to entry makes it an attractive target for both opportunistic and sophisticated attackers.

Remediation

Immediately update the Video Conferencing with Zoom plugin to the patched version released after 4.6.7. Verify the patch version against the official WordPress plugin repository or the vendor advisory. After patching, conduct an access review: check Zoom meeting logs for unexpected participants, audit recorded meetings for unauthorized attendance, and rotate the Zoom SDK API key and any related credentials as a precaution. Organizations unable to patch immediately should consider disabling the plugin until an update is available.

Patch guidance

Check the WordPress plugin repository or the plugin vendor's official website for the patched version that addresses CVE-2026-6964. Apply the update as soon as it is available; there is no workaround. Test the update in a staging environment before deploying to production to ensure compatibility with your WordPress installation and other plugins. After patching, verify that Zoom meeting functionality continues to work correctly.

Detection guidance

Monitor web server access logs for requests to the vulnerable plugin's endpoints that expose credentials or issue JWTs. Look for patterns of unauthenticated access to sensitive plugin functions. Review Zoom meeting participant logs and audit reports for unexpected attendees or sessions with no corresponding invite history. Enable WordPress security logging and audit plugins to flag unauthorized API key or token exposure. Check for any HTTP requests originating from external IP addresses that successfully retrieved Zoom credentials.

Why prioritize this

Although the CVSS score is MEDIUM (5.3), this vulnerability warrants urgent prioritization. The exploit is trivial—requiring only an HTTP request—making it likely to be targeted widely and quickly. The asset at risk is high-value: Zoom meeting access and API credentials expose sensitive business conversations. The vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, but given the ease of exploitation and the frequency of social engineering around video calls, proactive patching is essential before the vulnerability becomes widely weaponized.

Risk score, explained

The CVSS score of 5.3 reflects a limited immediate impact profile: the vulnerability discloses credentials but does not directly corrupt data or disrupt services. However, the score does not fully capture the downstream risk. Once an attacker possesses the API key and JWT, they gain unauthorized access to all Zoom meetings associated with that account. The practical severity depends on the organization's use of Zoom for sensitive communications. For companies that use Zoom for board meetings, client calls, or confidential discussions, the real-world risk is substantially higher than the CVSS score indicates. The attack vector (network, unauthenticated, no user interaction) is the primary factor elevating urgency.

Frequently asked questions