Sensitive Information Exposure in eRoom – Zoom Meetings & Webinars Plugin for WordPress
CVE-2024-3275

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Eroom – Webinar & Meeting Plugin For Zoom, Google Meet, Microsoft Teams
Vendor
CVE Published:
2 May 2024

What is CVE-2024-3275?

The eRoom – Zoom Meetings & Webinars plugin for WordPress has a flaw in the search_posts function that allows authenticated attackers with subscriber-level access or higher to access sensitive excerpts of posts, including draft and pending content. This vulnerability potentially exposes confidential information which could lead to further exploitation, compromising the integrity of user data and privacy.

Affected Version(s)

eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams 0 <= 1.4.18

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Krzysztof Zając
.