Sensitive Information Exposure in Video Conferencing Plugin for WordPress
CVE-2023-3947

5.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Video Conferencing with Zoom
Vendor
CVE Published:
26 July 2023

Summary

The Video Conferencing with Zoom plugin for WordPress has a serious flaw due to the presence of a hardcoded encryption key in the 'vczapi_encrypt_decrypt' function. This vulnerability allows unauthorized attackers to exploit the weakness and potentially decrypt sensitive information, such as meeting IDs and passwords. Versions up to and including 4.2.1 are impacted, making it crucial for WordPress users to assess their security and apply necessary updates.

Affected Version(s)

Video Conferencing with Zoom * <= 4.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/video-conferen...
https://plugins.trac.wordpress.org/browser/video-conferen...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lana Codes
.