EUVD-2026-42848
GHSA-mvg8-4w53-3c5g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network CSRF requiring admin interaction; availability rated Low because credential deletion fully disables plugin functionality until manually restored.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The GoodMeet - Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.8. This is due to a missing nonce verification in the reset_credential() function, which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action. While the function does verify the user's capability (manage_options), it does not validate a nonce, making it susceptible to CSRF attacks. This makes it possible for unauthenticated attackers to trick a site administrator into clicking a malicious link that will reset (delete) the plugin's stored Google Meet API credentials (goodmeet_google_credentials) and OAuth tokens (goodmeet_google_token), effectively disabling the Google Meet integration on the site.
AnalysisAI
Cross-Site Request Forgery in the GoodMeet WordPress plugin (versions up to and including 1.1.8) enables unauthenticated remote attackers to wipe a site's stored Google Meet API credentials and OAuth tokens by deceiving a logged-in administrator into triggering a crafted request. The vulnerable reset_credential() function handling the wp_ajax_goodmeet_reset_google_meet_credential AJAX action checks the manage_options capability but omits mandatory WordPress nonce validation, allowing any cross-origin request to be processed as legitimate. The practical outcome is complete disabling of the site's Google Meet integration with no data disclosure; no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
The vulnerability exists within the GoodMeet - Google Meet Integration for Webinar, Meeting & Video Conference WordPress plugin developed by Sovlix (CPE: cpe:2.3:a:sovlix:goodmeet_-_google_meet_integration_for_webinar,_meeting_&_video_conference:*:*:*:*:*:*:*:*). The root cause is CWE-352 (Cross-Site Request Forgery): the reset_credential() method in includes/Goodmeet_Ajax.php (confirmed at line 140 in both the trunk and the 1.1.6 tag per WordPress SVN references) is registered as a privileged AJAX handler via the wp_ajax_goodmeet_reset_google_meet_credential action. WordPress's AJAX subsystem routes authenticated admin requests to this action solely on the basis of the session cookie; without a call to wp_verify_nonce(), any cross-origin request bearing that cookie succeeds. The function then deletes the goodmeet_google_credentials and goodmeet_google_token WordPress option values, which store the OAuth 2.0 tokens and API keys used to authenticate to the Google Meet API. The capability check (manage_options) is present but provides no CSRF protection, as it only confirms the request was made by an admin, not that the admin intended the action.
RemediationAI
A fix has been committed to the GoodMeet plugin repository, as confirmed by the SVN changeset at https://plugins.trac.wordpress.org/changeset?reponame=&old=3525854%40goodmeet&new=3525854%40goodmeet; however, the specific patched release version number is not independently confirmed from available data and should be verified against the plugin's official WordPress.org changelog before updating. Administrators should update the GoodMeet plugin to the latest available version from the WordPress plugin repository immediately. As a compensating control pending patching, restricting wp-admin access to known administrator IP addresses via server-level firewall rules or the WordPress admin IP allowlist will eliminate the cross-origin request surface entirely, with the trade-off of reducing admin flexibility for remote access. Administrators should also audit stored Google Meet credentials after any unexplained loss of integration functionality, as credential deletion leaves no native WordPress log entry by default - consider enabling an audit logging plugin such as WP Activity Log to detect unauthorized AJAX actions.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today