CVE-2026-1368

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

High · published February 18, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
70.5
In the wild
Unconfirmed
What it is

The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01312 · 70.5th percentile
Published
2026-02-18T06:00Z
EPSS history
Timeline
  • 18 FEB 06:00Z
    Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation
    cvelistv5