CyberRota Analysis
AI-GeneratedThe GoodMeet plugin for WordPress is vulnerable to Cross-Site Request Forgery due to a lack of nonce verification in the reset_credential() function, affecting versions up to 1.1.8. This vulnerability allows unauthenticated attackers to potentially reset the plugin's Google Meet API credentials and OAuth tokens, disrupting the integration for site administrators. WordPress site owners using this plugin should prioritize patching to mitigate the risk of unauthorized credential resets.
Original NVD Description
The GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.8. This is due to a missing nonce verification in the reset_credential() function, which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action. While the function does verify the user's capability (manage_options), it does not validate a nonce, making it susceptible to CSRF attacks. This makes it possible for unauthenticated attackers to trick a site administrator into clicking a malicious link that will reset (delete) the plugin's stored Google Meet API credentials (goodmeet_google_credentials) and OAuth tokens (goodmeet_google_token), effectively disabling the Google Meet integration on the site.