eRoom Plugin CVE-2025-11760

Exploitation requires that the eRoom plugin (version <= 1.5.6) be installed and that its Zoom integration be configured with an SDK secret, and that a page using the plugin's meeting_view template be publicly reachable so the client-side JavaScript containing sdk_secret is served to the attacker. No authentication, user interaction, or special attacker privileges are needed (AV:N/AC:L/PR:N/UI:N) - the secret is exposed in default rendering of the meeting view to any visitor. The practical limiting factors are: the site must actually have the Zoom (not only Google Meet or Teams) integration enabled with a real sdk_secret, and the meeting view must be exposed to unauthenticated users; sites using only the Google Meet or Microsoft Teams integrations, or restricting meeting pages to logged-in users, reduce or eliminate exposure.

This is a medium-severity information-disclosure issue (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) whose signals consistently point to real-but-limited risk rather than an urgent emergency. The CVSS vector confirms fully remote, unauthenticated, low-complexity access with no user interaction, which raises exploitability, but impact is scoped to confidentiality only (C:L) - the leak of the Zoom sdk_secret - with no direct integrity or availability effect on the WordPress host. EPSS is low at 0.31% (22nd percentile), the CVE is NOT on the CISA KEV list, and no public exploit code is referenced, so there is no evidence of active or automated mass exploitation. Applying an SSVC lens: exploitation status is 'none' (no KEV/POC), the flaw is likely 'automatable' because the secret sits in static client-side JavaScript that any crawler can scrape, and technical impact is 'partial'. The signals are internally consistent - low EPSS, no KEV, and medium CVSS all agree this is a moderate-priority patch rather than a drop-everything event. The one nuance worth flagging: the described downstream effect (forging valid JWTs for unauthorized Zoom meeting access) is more serious than a C:L score suggests, because a leaked signing secret is a durable credential that must be rotated, not merely patched - the CVSS base score does not capture that the Zoom integration itself is compromised.

An unauthenticated attacker browses to a public page rendered by the eRoom plugin's meeting_view template and simply views the page source or inspects the returned client-side JavaScript, where the Zoom sdk_secret is embedded. Having harvested the secret, the attacker uses it to generate valid JWT signatures and join or access Zoom meetings without authorization, impersonating the legitimate integration. No public exploit code is referenced, but no tooling is required - the secret is readable directly in the browser.