Information Exposure Vulnerability in eRoom - Webinar & Meeting Plugin for WordPress
CVE-2025-11760
5.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 25 October 2025
What is CVE-2025-11760?
The eRoom - Webinar & Meeting Plugin for WordPress, which integrates with Zoom, Google Meet, and Microsoft Teams, is susceptible to a serious information exposure issue. This vulnerability allows unauthenticated users to access sensitive SDK secrets stored in JavaScript on the client side. Specifically, the plugin inadvertently reveals Zoom SDK secret keys in the meeting view template, enabling attackers to obtain the sdk_secret value. This breach can lead to the unauthorized generation of valid JWT signatures, granting access to secured meetings and compromising the integrity of the Zoom integration.
Affected Version(s)
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams * <= 1.5.6