Skip to content
OpenAdvisories
Medium · 4.3 Public exploit CVE-2026-6440 EUVD-2026-42848GHSA-mvg8-4w53-3c5g

GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'

Published Jul 10, 2026 · Updated Jul 10, 2026 · Assigned by Wordfence

Vendor: Sovlix Product: GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference Category: Web / CMS

Description

The GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.1.8. This is due to a missing nonce verification in the reset_credential() function, which handles the wp_ajax_goodmeet_reset_google_meet_credential AJAX action. While the function does verify the user's capability (manage_options), it does not validate a nonce, making it susceptible to CSRF attacks. This makes it possible for unauthenticated attackers to trick a site administrator into clicking a malicious link that will reset (delete) the plugin's stored Google Meet API credentials (goodmeet_google_credentials) and OAuth tokens (goodmeet_google_token), effectively disabling the Google Meet integration on the site.

Affected products

VendorProductAffectedFixed
sovlix GoodMeet – Google Meet Integration for Webinar, Meeting & Video Conference ≤ 1.1.8 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • Alixploit22/CVE-2026-6440 ★ 0 · Aug 15, 2026

    mencari sebuah kerentanan, wodpres dan mengungah shell di kerentanan wodpres tersebut

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References