CVE-2026-6440
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The GoodMeet plugin for WordPress up to version 1.1.8 is vulnerable to Cross-Site Request Forgery due to missing nonce verification in the reset_credential() function. An attacker can trick a site administrator into clicking a malicious link, which will delete stored Google Meet API credentials and OAuth tokens, disabling the Google Meet integration on the site.
Risk Assessment
The risk is that an unauthenticated attacker can disable the Google Meet integration, potentially disrupting webinar and meeting functionality on the WordPress site.
Recommendation
It is recommended to immediately update the GoodMeet plugin to the latest available version that includes a fix for the CSRF vulnerability.
Related vulnerabilities
- CVE-2026-77524Critical
KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential; the JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, allowing the attacker to obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations.
- CVE-2026-76519CriticalActively exploited
A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. It is due to improper handling of email attachments when the file reputation service is enabled; an attacker could send an email with a crafted attachment through an affected device, potentially allowing arbitrary file writes and command execution with root privileges.
- CVE-2026-33796Critical
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.
- CVE-2026-33792Critical
A stack-based buffer overflow vulnerability in the srxpfe process of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to execute code as root or cause a denial of service via a crafted packet received on a configured GRE tunnel.
- CVE-2026-33789Critical
A stack-based buffer overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated BGP peer to cause a denial of service and potential root-level command execution via crafted BGP route updates when the BGP Monitoring Protocol (BMP) is enabled.
- CVE-2026-109439Critical
A missing authentication vulnerability in Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718. Attackers can send a type 0xF8 query to read live configuration data and a type 0xFD frame with exactly 0x78 body bytes to rewrite the device IP address and serial-channel forwarding records, causing changes to commit to EEPROM and persist across reboots. The XPress-DR product series reached end-of-life/end-of-support in February 2025.
- CVE-2026-102182Critical
A stack-based buffer overflow vulnerability in the kmd component of Juniper Networks Junos OS on MX Series allows an unauthenticated network attacker to execute code as root via specific IKE certificate-based packets. This issue affects Junos OS on MX Series in versions before 21.2R3-S11, from 21.4 before 21.4R3-S12, from 22.2 before 22.2R3-S8, from 22.3 before 22.3R3-S5, and from 22.4 before 22.4R3-S9.
- CVE-2026-102178Critical
A stack-based buffer overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon denial of service via flowspec route re-advertisement when BGP update-threading is enabled.
- CVE-2026-102175Critical
A heap-based buffer overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection to execute code as root or cause denial of service via a crafted frame received over the service-deployment TCP connection.
- CVE-2026-102031Critical
An OS command injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled.
Original NVD description (English source)
The GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.8. This is due to a missing nonce verification in the reset_credential() function, which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action. While the function does verify the user's capability (manage_options), it does not validate a nonce, making it susceptible to CSRF attacks. This makes it possible for unauthenticated attackers to trick a site administrator into clicking a malicious link that will reset (delete) the plugin's stored Google Meet API credentials (goodmeet_google_credentials) and OAuth tokens (goodmeet_google_token), effectively disabling the Google Meet integration on the site.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS