eRoom EUVD-2026-108028

Exploitation requires the attacker to already hold a valid authenticated account on the target WordPress site at a low privilege level (PR:L) - typically a subscriber or similar role - making sites with open user registration most at risk. The flaw lies in the eRoom plugin's settings-change functionality failing to enforce a proper authorization/capability check, so the limiting factor is possession of any authenticated session rather than any specific non-default configuration. Impact is bounded to partial integrity and availability of the plugin's Zoom meeting/webinar integration settings (C:N, I:L, A:L); no user interaction is needed. Exploitation is limited by the requirement for authentication and by the plugin's presence and activation on the target site.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the eRoom WordPress plugin, rated CVSS 5.4. The provided vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) indicates network-reachable, low-complexity exploitation that requires an already-authenticated low-privileged account (PR:L) and no user interaction, with no confidentiality impact but limited integrity and availability impact - consistent with an under-privileged user (e.g., a subscriber-level account) being able to change plugin settings they should not control. No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the realistic threat is a low-privileged authenticated user abusing broken access control rather than mass unauthenticated compromise. On balance this is a real but lower-priority issue: the CVSS is capped in the medium range precisely because it needs valid credentials and yields only partial integrity/availability impact. The single-source origin (Patchstack) and absence of an independent vendor advisory in the input are the main confidence gaps. Note the supplied 'Authentication Bypass' tag conflicts with the actual weakness - CWE-862 is a missing-authorization (broken access control) issue affecting an authenticated user, not an authentication bypass; treat the tag with caution.

An attacker who holds any low-privileged account on the target WordPress site (for example a self-registered subscriber on a site with open registration) sends a request to an eRoom plugin endpoint that fails to verify the caller's authorization level, allowing them to modify plugin settings they should not be able to touch. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, this needs only valid low-level credentials, no victim interaction, and no special tooling. No public exploit was identified in the provided data, so exploitation would require the attacker to craft the request against the vulnerable settings-change handler themselves.