What is the CVSS score of CVE-2026-25427?

CVE-2026-25427 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

eRoom CVE-2026-25427

EUVD-2026-48149 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-ggjw-gw38-xx97

WordPress Authentication Bypass Eroom Wordpress Plugin

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-accessible WordPress endpoint; subscriber account required (PR:L); no confidentiality breach; limited integrity and availability impact only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:01 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

AnalysisAI

Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to perform privileged actions beyond their intended scope, resulting in limited integrity and availability impact. Reported by Patchstack against CPE cpe:2.3:a:digitalme:eroom, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints accessible to the lowest default WordPress user role. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

eRoom is a WordPress plugin developed by DigitalMe that integrates Zoom meetings and webinars into WordPress sites. The affected CPE is cpe:2.3:a:digitalme:eroom:*:*:*:*:*:*:*:*, covering all versions through 1.7.1. The root cause is CWE-862 (Missing Authorization), a class of flaw where a WordPress plugin exposes AJAX actions, REST API endpoints, or admin-facing handlers without verifying the requesting user's capability via WordPress nonce or capability checks (e.g., current_user_can()). In WordPress, the 'subscriber' role is the lowest default role, carrying only the 'read' capability. When plugin code omits proper authorization, subscriber-level users can invoke functionality intended for editors, administrators, or site owners - such as creating, modifying, or deleting meeting/webinar records.

RemediationAI

Update the eRoom plugin to a version released after 1.7.1 by following the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/eroom-zoom-meetings-webinar/vulnerability/wordpress-eroom-plugin-1-7-1-broken-access-control-vulnerability - the exact fixed version number is not independently confirmed from available data, so consult the WordPress plugin repository changelog for the patched release. As a compensating control pending a patch, disabling open user registration in WordPress (Settings > General, uncheck 'Anyone can register') prevents unauthenticated visitors from obtaining the subscriber role required to exploit this issue; note this trade-off blocks legitimate community registrations. If subscriber accounts must remain open, consider a Web Application Firewall rule to restrict access to the specific eRoom AJAX or REST endpoints identified in the Patchstack report.