DigitalME eRoom CVE-2026-114176

Exploitation requires an existing authenticated WordPress account on a site with the eRoom (eroom-zoom-meetings-webinar) plugin installed at version 1.7.1 or earlier; per CVSS PR:L the attacker needs at least low-level credentials (e.g. a subscriber account), which on sites allowing open registration is a low bar but on closed sites is a meaningful limiting factor. No user interaction is required (UI:N) and the vector is network-reachable (AV:N). The impact is bounded to limited integrity changes only (C:N/A:N), and the precise plugin action exposed by the missing authorization check is not specified in the available data, which further limits assessment of worst-case impact.

This is a genuinely low-to-moderate priority issue, not a critical one, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 Medium) describes a network-reachable but authenticated flaw (PR:L) with only limited integrity impact and no confidentiality or availability impact - a classic broken-access-control/missing-authorization weakness (CWE-862) where a low-privileged WordPress user can invoke an action they should not. No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit referenced, so there is no evidence of active or widespread exploitation. The single source is a Patchstack advisory, which is a reliable WordPress-focused feed but means versioning and impact rest on one vendor. The main caveat: the description ('Exploiting Incorrectly Configured Access Control Security Levels') is vague about exactly which plugin action is exposed, so the real-world integrity impact could range from trivial to meaningful depending on what the unauthorized endpoint does - verify the specific affected function with Patchstack before deprioritizing entirely.

A low-privileged authenticated WordPress user (e.g. a subscriber-level account on a site running the eRoom plugin) sends a request to a plugin endpoint that lacks a proper capability/authorization check, performing a state-changing action reserved for higher-privileged roles. The limited integrity impact (I:L) means the attacker can modify some plugin-managed data but cannot read sensitive data or take the site down. No public proof-of-concept is referenced, so exploitation would require an attacker to identify the specific unprotected action.