CVE-2026-6964 is an authorization bypass vulnerability (CWE-862) in the j_3rk Video Conferencing with Zoom WordPress plugin. Versions up to and including 4.6.7 do not properly verify user authorization before allowing access to sensitive Zoom credentials. Exploiting this flaw, unauthenticated attackers can retrieve the Zoom SDK API key and a freshly-signed JWT token, enabling them to join Zoom meetings linked to those credentials without invitation. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker can bypass authorization controls to obtain sensitive Zoom API credentials and JWT tokens. This enables unauthorized joining of Zoom meetings associated with the compromised credentials, potentially exposing meeting content to unauthorized parties. The impact is limited to confidentiality (partial information disclosure) with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for suspicious activity. Avoid exposing Zoom API credentials publicly and consider disabling the plugin if possible to prevent exploitation.