Zoom
CVE-2026-1368
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess vulnerable AJAX handler endpoint
-
ExploitBypass missing nonce verification
-
ExecutionGenerate valid Zoom SDK signature
-
ImpactRetrieve site's Zoom SDK key
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Video Conferencing with Zoom WordPress plugin version before 4.6.6 with AJAX handler nonce verification commented out. Requires plugin installation and activation on WordPress site with default AJAX endpoint accessibility. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Video Conferencing with Zoom WordPre versions up to 4.6.6 is affected by improper authentication (CVSS 7.5).
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected ProductsAI
Product: Video Conferencing with Zoom WordPre. Versions: up to 4.6.6. Component: before 4.6.6 contains an AJAX.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-287: Improper Authentication) exists in the before 4.6.6 contains an AJAX component. The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.
Know when Zoom gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Video Conferencing with Zoom WordPress plugin before 4.6.6 contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.
Executive ViewAI
A high-severity authentication vulnerability in Zoom WordPress plugin versions up to 4.6.6 could allow unauthorized users to bypass security controls and gain inappropriate access to video conferencing features. Organizations using this plugin face immediate risk of unauthorized meeting access, data exposure, and potential meeting hijacking until remediation is completed.
Disable the Zoom WordPress plugin entirely until patch availability; implement WAF rules to block suspicious authentication requests to the plugin endpoints; restrict plugin access via network segmentation and IP whitelisting; enforce additional authentication layers (MFA) at the WordPress level; monitor and log all authentication attempts to the plugin; consider disabling Zoom integration features within WordPress and using the standalone Zoom application instead.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when c
Stack-based buffer overflow in the ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 allows remote
An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including anima
Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary cod
An exploitable partial path traversal vulnerability exists in the way Zoom Client version 4.6.10 processes messages incl
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-134
Zoom Client for Meetings through 4.6.8 on macOS copies runwithroot to a user-writable temporary directory during install
airhost.exe in Zoom Client for Meetings 4.6.11 uses 3423423432325249 as the Initialization Vector (IV) for AES-256 CBC e
airhost.exe in Zoom Client for Meetings 4.6.11 uses the SHA-256 hash of 0123425234234fsdfsdr3242 for initialization of a
Zoom Client for Meetings through 4.6.9 uses the ECB mode of AES for video and audio encryption. Rated high severity (CVS
In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a v
GitHub PoC
Exploit-DB