GoodMeet <= 2.0.0 - Unauthenticated Sensitive Information Exposure via 'goodmeet_meeting_list' AJAX Action
- ID
- WPSEC-2026-0418
- Plugin
- GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference (goodmeet)
- Affected
- all versions before 2.1.0
- Remediation
- Update to 2.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- GoodMeet on WPSec AttackSurface
- Fix released
- Published
Description
The GoodMeet plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.0 via the 'goodmeet_meeting_list' AJAX action, which is available to unauthenticated users. The goodmeet_meetings() function limited the query to the current user's meetings, but for logged-out visitors the user ID is 0, which WP_Query ignores, and its post status filter used an invalid value that is also ignored. This makes it possible for unauthenticated attackers to retrieve every meeting on the site, including unpublished meetings and meetings restricted to logged-in users or selected roles, together with their stored settings such as the meeting password, host user ID and schedule.
References
- https://wpsec.com/vuln/WPSEC-2026-0418/
- https://plugins.svn.wordpress.org/goodmeet/tags/2.1.0/
- https://wordpress.org/plugins/goodmeet/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS