An unauthenticated authentication bypass in the Video Conferencing with Zoom plugin exposes sensitive Zoom SDK credentials to unauthorized remote attackers.

This vulnerability is an improper authentication flaw (CWE-287) where an AJAX handler lacks necessary nonce verification, allowing unauthenticated users to generate valid Zoom SDK signatures and access site keys.

The exposure of Zoom SDK keys and the ability to generate valid meeting signatures allows an attacker to interact with the site's Zoom integration without authorization. Given the CVSS score of 7.5, this high-severity flaw could lead to unauthorized data access or the impersonation of legitimate meeting hosts, potentially resulting in significant operational disruption and a breach of communication privacy.

Immediate Action: Update the Video Conferencing with Zoom plugin to version 4.6.6 or later immediately to restore mandatory nonce verification.

Proactive Monitoring: Review web server logs for suspicious requests directed toward the plugin's AJAX endpoints, particularly those originating from unauthorized or unknown IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the specific AJAX endpoints associated with the Zoom plugin until the update is applied.

Public Exploit Available: No (The provided data indicates no weaponized exploit or published Proof of Concept exists; only a Nuclei detection template is available).

The vulnerability presents a clear risk to the integrity of Zoom integrations within affected WordPress environments. Administrators must prioritize updating the plugin to version 4.6.6 to eliminate the authentication bypass. Failure to patch this vulnerability leaves the Zoom SDK configuration exposed to any remote, unauthenticated actor on the internet.