Video Conferencing with Zoom EUVD-2026-92313

Requires an authenticated low-privilege account on the target WordPress site (CVSS PR:L) - the plugin returns data that embeds sensitive information to users who should not receive it. Exploitation is limited by that authentication requirement: a valid account (potentially self-registered where open registration is enabled) is mandatory, no administrative access is needed, and no user interaction is required (UI:N). The plugin 'Video Conferencing with Zoom' (video-conferencing-with-zoom-api) version 4.6.10 or earlier must be installed and active. Risk is highest on sites that allow public/subscriber-level registration; sites restricting account creation materially reduce exposure.

This is a moderate-severity information disclosure flaw (CVSS 4.0 base 5.3) in a WordPress plugin, and the signals consistently point to real-but-limited risk rather than an urgent emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates network-reachable, low-complexity exploitation but requires authentication at a low privilege level (PR:L), so an attacker must already hold a valid account on the WordPress site. Impact is confidentiality-only and rated Low (VC:L, with VI:N/VA:N), consistent with CWE-201 (Insertion of Sensitive Information Into Sent Data) - likely exposure of embedded secrets such as Zoom API credentials rather than full compromise. No CISA KEV listing and no public exploit were provided in the input, and no EPSS score was supplied, so there is no evidence of active or automated exploitation. The SSVC framework data was not provided. Net: a legitimate but lower-priority issue - patch in the normal cycle, prioritizing sites with untrusted low-privilege user registration enabled.

An attacker who registers or already holds a low-privilege account (e.g., subscriber) on a WordPress site running the plugin calls an accessible plugin endpoint and receives a response that embeds sensitive data they should not see, such as Zoom API keys or meeting credentials. No public exploit code was identified in the provided data, and exploitation requires authentication and low attack complexity (PR:L/AC:L).