Eroom
Monthly
SQL injection in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets an authenticated Contributor-level user inject arbitrary SQL and read backend database contents. Reported by Patchstack and rated CVSS 8.5, the flaw carries a scope change (S:C) meaning the injected query can reach data beyond the plugin's own boundary. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low attacker prerequisites make it a credible risk on any multi-author site running the plugin.
Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to perform privileged actions beyond their intended scope, resulting in limited integrity and availability impact. Reported by Patchstack against CPE cpe:2.3:a:digitalme:eroom, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints accessible to the lowest default WordPress user role. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
SQL injection in the eRoom (Zoom Meetings & Webinar) WordPress plugin through version 1.7.1 lets an authenticated Contributor-level user inject arbitrary SQL and read backend database contents. Reported by Patchstack and rated CVSS 8.5, the flaw carries a scope change (S:C) meaning the injected query can reach data beyond the plugin's own boundary. There is no public exploit identified at time of analysis and no CISA KEV listing, so exploitation is currently theoretical but the low attacker prerequisites make it a credible risk on any multi-author site running the plugin.
Broken access control in the eRoom WordPress plugin (versions ≤ 1.7.1) allows subscriber-level authenticated users to perform privileged actions beyond their intended scope, resulting in limited integrity and availability impact. Reported by Patchstack against CPE cpe:2.3:a:digitalme:eroom, the flaw stems from missing authorization checks (CWE-862) on one or more plugin endpoints accessible to the lowest default WordPress user role. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.