EUVD-2026-96472
GHSA-wgrv-jcgv-cwvg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running eRoom <= 1.7.1
-
DeliverySend crafted request to vulnerable endpoint
-
ExploitBypass broken authentication check (CWE-288)
-
ExecutionAccess protected data or actions
-
ImpactPartial confidentiality/integrity/availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Requires only that the target WordPress site has the eRoom (Zoom Meetings & Webinar) plugin installed and active at version 1.7.1 or earlier and is network-reachable; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special configuration, and no user interaction are needed. The primary limiting factor is deployment scope - the flaw only affects sites running this specific plugin within the vulnerable version range; sites on a patched/later release or without the plugin are unaffected. Impact is bounded to Low across confidentiality, integrity, and availability, so exploitation yields partial access rather than full site takeover based on available data. |
| Impact | Moderate priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, base 7.3 HIGH) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, consistent with the 'Unauthenticated Broken Authentication' description and CWE-288. This makes it trivially reachable in principle. However, all other exploitation signals are absent or neutral: no EPSS score was provided, the CVE is not on CISA KEV, and no public proof-of-concept is referenced (only a single Patchstack advisory). The 7.3 score is driven by the no-auth/no-interaction metrics rather than by severe impact - each of C/I/A is only Low, indicating partial rather than full compromise. Net: this is a genuine unauthenticated weakness worth patching, but there is no evidence of active or widespread exploitation, so it reads as a high-CVSS-by-access-vector issue with limited (Low) impact rather than a critical emergency. Data gap: the Patchstack entry gives no EPSS, no fix-version detail beyond '<= 1.7.1 affected', and no description of the exact bypassed authentication mechanism - verify specifics with the vendor/Patchstack before prioritizing. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a crafted request to a WordPress site running the eRoom (Zoom Meetings & Webinar) plugin at version 1.7.1 or earlier, bypassing an authentication check to reach functionality or data that should be protected. Because no authentication or user interaction is needed, exploitation can be scripted against exposed sites. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 10, 2026
Unauthenticated broken-authentication flaw in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets remote attackers bypass plugin-level authentication checks and obtain limited read, write, and availability impact (CVSS 7.3, C:L/I:L/A:L). Exploitation requires only network reachability to a site with an active vulnerable copy of the plugin - the assessed vector is AV:N/AC:L/PR:N/UI:N, so no credentials, special configuration, or user interaction are needed - while sites on a later release or without the plugin are unaffected. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is bounded by how widely the plugin is deployed and is rated moderate priority.
RemediationAI
No vendor-released patch version is identified in the available data; the sole reference is the Patchstack advisory for the eRoom plugin 1.7.1 broken-authentication issue (https://patchstack.com/database/wordpress/plugin/eroom-zoom-meetings-webinar/vulnerability/wordpress-eroom-plugin-1-7-1-broken-authentication-vulnerability?_s_id=cve), which should be monitored for a fixed release and for the vendor's own changelog entry. Because the impact is limited (Low across confidentiality, integrity, and availability) and requires an active vulnerable plugin, the most reliable immediate control is to deactivate and, if it is not required, uninstall the eRoom plugin until a patched version is available - the trade-off is complete loss of the Zoom meeting/webinar functionality it provides. If the plugin must stay live, front it with a WAF or Patchstack-style virtual patching rule that blocks unauthenticated requests targeting the plugin's endpoints (admin-ajax.php actions and any REST routes registered under the plugin namespace), accepting that this requires accurate rule coverage and may break legitimate unauthenticated front-end flows such as meeting registration. Additionally, restrict administrative access to the site, review logs for unexpected unauthenticated calls to plugin routes as a detection measure, and re-check the advisory before re-enabling the plugin; none of these compensating controls remove the underlying CWE-288 defect, so patching remains the definitive fix once a version is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) in a WordPress plugin, eRoom (Zoom Meetings & Webinar), published by digitalme and catalogued under CPE cpe:2.3:a:digitalme:eroom:*:*:*:*:*:*:*:*. In the WordPress plugin model, privileged functionality is normally reached through admin-ajax.php actions or REST routes guarded by current_user_can() capability checks and nonce verification; a CWE-288 failure means the same or equivalent functionality can be reached through a path where those authentication checks are never applied, allowing an unauthenticated requester to invoke it directly. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L confirms the attack is remote, low complexity, unauthenticated, and requires no user interaction, with scope unchanged and only Low confidentiality, integrity, and availability impact - consistent with partial exposure or limited state changes (the Patchstack tagging includes 'Information Disclosure') rather than full site takeover. The root cause sits in the plugin's own access-control logic, not in WordPress core or the Zoom API integration itself.
Know when Eroom gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Broken authentication (CWE-288) reachable over the network with no privileges or interaction (AV:N/AC:L/PR:N/UI:N); impact limited to partial C/I/A, so each set to Low.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.
Executive ViewAI
The eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 contains an unauthenticated broken-authentication flaw that allows a remote attacker to bypass plugin-level authentication checks and obtain limited read, write, and availability impact on any site running an affected copy. No credentials, special configuration, or user interaction are required - only network reachability - so every externally reachable site still on version 1.7.1 or earlier remains exposed, and no public exploit code has been identified at time of analysis. Leadership should track this at moderate priority: no vendor-released patch has been identified at time of analysis, per-incident impact is limited, and overall risk is driven primarily by how many sites in the estate still run the vulnerable plugin.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall the eRoom (Zoom Meetings & Webinar) plugin on every site running version 1.7.1 or earlier; block network access to plugin endpoints via WAF or reverse-proxy rules; isolate affected WordPress environments and restrict administrator access; and monitor sites for unauthorized content, configuration, or plugin file changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets an authenticated Contri
Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to pe
Exploit-DB