Vulnerabilities / Zoom for WordPress / WPSEC-2026-0336
Zoom for WordPress <= 1.5.4 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Log Files
Medium 5.3
CWE-532Fixed in 1.6.0
- ID
- WPSEC-2026-0336
- Plugin
- wp-zoom (wp-zoom)
- Affected
- from 1.2.0 before 1.6.0
- Remediation
- Update to 1.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-532
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Zoom for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The Zoom for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions 1.2.0 up to, and including, 1.5.4. Whenever a Zoom API request fails, the plugin writes the full request body to a date-named log file (wp-zoom-YYYY-MM-DD.log) in the publicly accessible wp-content/uploads/wp-zoom-logs/ directory. For webinar registrations, that body includes the customer's name, email address, billing address, phone number, company, and custom question answers. This makes it possible for unauthenticated attackers to download these log files and obtain customers' personal data.
References
- https://wpsec.com/vuln/WPSEC-2026-0336/
- https://plugins.svn.wordpress.org/wp-zoom/tags/1.6.0/
- https://wordpress.org/plugins/wp-zoom/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS