PT-2026-20277 · Zoom Video Communications+1 · Zoom+1

Published 2026-02-18 · Updated 2026-04-30 · CVE-2026-1368

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Video Conferencing with Zoom WordPress plugin versions prior to 4.6.6

Description The Video Conferencing with Zoom WordPress plugin has an AJAX handler where the security check for generated signatures is disabled. This allows attackers who are not logged in to create valid Zoom SDK signatures for any meeting ID and obtain the Zoom SDK key associated with the website.

Recommendations Update the Video Conferencing with Zoom WordPress plugin to version 4.6.6 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-1368

Affected Products

Video Conferencing With Zoom

Zoom

References · 8

• 🔥 https://wpscan.com/vulnerability/218e6655-c5aa-4bce-86b2-cad3bb20020c · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-1368 · Security Note
• https://twitter.com/VulmonFeeds/status/2024054096894820522 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/2049745601924071853 · Twitter Post
• https://twitter.com/cracbot/status/2025888425149407641 · Twitter Post
• https://twitter.com/CVEnew/status/2024011992588316923 · Twitter Post
• https://t.me/cveNotify/152284 · Telegram Post
• https://t.me/CVEtracker/44932 · Telegram Post