What is the CVSS score of CVE-2026-25405?

CVE-2026-25405 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of eRoom are affected by CVE-2026-25405?

The eRoom WordPress plugin (versions ≤1.7.1) for Zoom integration contains an SQL injection vulnerability (CVSS 8.5) allowing authenticated contributors to extract sensitive database contents.

How to fix or mitigate CVE-2026-25405?

Within 24 hours: Audit all WordPress accounts with Contributor, Author, and Editor roles on instances running eRoom ≤1.7.1; immediately deactivate the plugin if Zoom meeting integration is not operationally critical, or isolate it and document dependencies. Within 7 days: Query database logs for suspicious SQL patterns and conduct integrity audit of all tables; restrict the WordPress database user account to read-only permissions on non-sensitive tables to limit injection scope. Within 30 days: Migrate to an alternative Zoom WordPress integration solution or vendor-approved replacement; implement organizational policy requiring security review before granting Contributor role access and limiting assignments to essential personnel only.

eRoom CVE-2026-25405

EUVD-2026-48147 HIGH

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-32m9-v73v-vqc6

WordPress SQLi Eroom Wordpress Plugin

8.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Contributor authentication makes PR:L; network SQLi with no interaction gives AV:N/AC:L/UI:N; read-based injection exposes database data (C:H) with no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:17 vuln.today

CVE Published

Jul 23, 2026 - 11:17 cve.org

HIGH 8.5

DescriptionCVE.org

Contributor SQL Injection in eRoom <= 1.7.1 versions.

AnalysisAI

SQL injection in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets an authenticated Contributor-level user inject arbitrary SQL and read backend database contents. Reported by Patchstack and rated CVSS 8.5, the flaw carries a scope change (S:C) meaning the injected query can reach data beyond the plugin's own boundary. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low attacker prerequisites make it a credible risk on any multi-author site running the plugin.

Technical ContextAI

eRoom is a WordPress plugin (vendor CPE cpe:2.3:a:digitalme:eroom) that integrates Zoom Meetings and Webinars into WordPress sites, exposing meeting/webinar management to logged-in authors. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reachable by a Contributor role is concatenated into a SQL statement without adequate parameterization or sanitization, so crafted values alter the query executed against the WordPress MySQL/MariaDB database. Because WordPress runs all plugin database access through a shared wpdb connection with full schema privileges, a single injectable parameter can expose the entire site database including the wp_users and wp_options tables.

RemediationAI

No vendor-released patch version was identified in the provided data; because the flaw is bounded as affecting 'eRoom <= 1.7.1', administrators should check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/eroom-zoom-meetings-webinar/vulnerability/wordpress-eroom-plugin-1-7-1-sql-injection-vulnerability) and the WordPress.org plugin page for a release newer than 1.7.1 and upgrade to it once confirmed. Until a fixed version is verified and applied, restrict who can hold Contributor (and higher author) roles and audit existing low-privilege accounts, since exploitation requires an authenticated Contributor; consider temporarily deactivating the eRoom plugin if Zoom integration is non-essential, accepting the trade-off of losing meeting/webinar embedding. As a compensating control, deploy a WordPress-aware WAF (such as Patchstack or Wordfence) with SQL-injection rules and enable virtual patching for this CVE, and monitor database query logs for anomalous UNION/OR-based patterns from author-level sessions.