CVE-2026-39653
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Video Conferencing with Zoom WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 4.6.6.
Risk Assessment
An unauthorized user can access conference management functions, potentially leading to data leakage or service disruption.
Recommendation
Update the Video Conferencing with Zoom plugin to the latest version and review permission settings.
Other vulnerabilities in Video Conferencing with Zoom
See all- CVE-2026-103335Medium
The Video Conferencing with Zoom WordPress plugin contains an insertion of sensitive information into sent data vulnerability, allowing retrieval of embedded sensitive data. The issue affects versions up to and including 4.6.10.
- CVE-2026-66641Medium
Cross Site Scripting (XSS) vulnerability in Video Conferencing with Zoom in versions up to 4.6.8. A user with Contributor role can inject malicious script.
Original NVD description (English source)
Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Video Conferencing with Zoom: from n/a through <= 4.6.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS