CVE-2025-11760

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11760", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-14T20:12:49.862Z", "datePublished": "2025-10-25T01:45:55.977Z", "dateUpdated": "2026-04-08T16:34:54.332Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:54.332Z"}, "affected": [{"vendor": "digitalmeactivecampaign", "product": "eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.5.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access."}], "title": "eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0baaa6b7-3884-465e-bae3-46edab6312d4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/eroom-zoom-meetings-webinar/tags/1.5.6/templates/single/meeting_view.php#L173"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3379064%40eroom-zoom-meetings-webinar%2Ftrunk&old=3375935%40eroom-zoom-meetings-webinar%2Ftrunk&sfp_email=&sfph_mail=#file4"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor", "cweId": "CWE-200", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "timeline": [{"time": "2025-10-15T13:48:18.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-24T13:42:10.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T15:27:43.795096Z", "id": "CVE-2025-11760", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:57:29.737Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11760", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T15:27:43.795096Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T15:27:50.361Z"}}], "cna": {"title": "eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure", "credits": [{"lang": "en", "type": "finder", "value": "Rafshanzani Suhada"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "digitalmeactivecampaign", "product": "eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.5.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-15T13:48:18.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-24T13:42:10.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0baaa6b7-3884-465e-bae3-46edab6312d4?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/eroom-zoom-meetings-webinar/tags/1.5.6/templates/single/meeting_view.php#L173"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3379064%40eroom-zoom-meetings-webinar%2Ftrunk&old=3375935%40eroom-zoom-meetings-webinar%2Ftrunk&sfp_email=&sfph_mail=#file4"}], "descriptions": [{"lang": "en", "value": "The eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:54.332Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11760", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:34:54.332Z", "dateReserved": "2025-10-14T20:12:49.862Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-25T01:45:55.977Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams", "vendor": "digitalmeactivecampaign", "versions": [{"lessThanOrEqual": "1.5.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access."}, {"lang": "es", "value": "El plugin eRoom - Webinar & Meeting para Zoom, Google Meet, Microsoft Teams para WordPress es vulnerable a la exposici\u00f3n de informaci\u00f3n sensible en todas las versiones hasta la 1.5.6, inclusive. Esto se debe a que el plugin expone las claves secretas del SDK de Zoom en JavaScript del lado del cliente dentro de la plantilla de vista de reuni\u00f3n. Esto permite a atacantes no autenticados extraer el valor sdk_secret, que deber\u00eda permanecer en el lado del servidor, comprometiendo la seguridad de la integraci\u00f3n de Zoom y permitiendo a los atacantes generar firmas JWT v\u00e1lidas para acceso no autorizado a reuniones."}], "id": "CVE-2025-11760", "lastModified": "2026-10-08T11:10:00.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11760", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-27T15:27:43.795096Z", "version": "2.0.3"}}]}, "published": "2025-10-25T02:15:38.397", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/eroom-zoom-meetings-webinar/tags/1.5.6/templates/single/meeting_view.php#L173"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3379064%40eroom-zoom-meetings-webinar%2Ftrunk&old=3375935%40eroom-zoom-meetings-webinar%2Ftrunk&sfp_email=&sfph_mail=#file4"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0baaa6b7-3884-465e-bae3-46edab6312d4?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T21:54:10.892217+00:00", "value": {"mitigation_remediation": ["Upgrade the eRoom plugin to a version that no longer embeds the Zoom SDK secret in client\u2011side scripts.", "If an update is not immediately available, edit the meeting_view.php template to remove or server\u2011side\u2011encode the sdk_secret variable so it is never sent to the browser.", "Ensure that all Zoom integration keys are stored strictly on the server and only used in authenticated server\u2011side code, preventing accidental exposure in rendering templates."], "summary": {"action": "Immediate Update", "impact": "Unauthorized Sensitive Data Exposure"}, "threat_synthesis": {"affected_systems": "This issue affects all installations of digitalmeactivecampaign\u2019s eRoom \u2013 Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams up to and including version 1.5.6. WordPress sites that have recent plugin versions but have not applied the fix are at risk.", "description_and_impact": "The eRoom \u2013 Webinar & Meeting Plugin for WordPress contains a flaw that exposes Zoom SDK secret keys in client\u2011side JavaScript within the meeting view template. A malicious actor who can access a meeting page can read the embedded sdk_secret value, an element that should remain on the server. With this secret the attacker can forge valid JSON Web Tokens, enabling intrusion into any Zoom meeting linked to the plugin and compromising both confidentiality and integrity of the meeting content.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a medium impact when measured against the exposed secret, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA\u2019s KEV catalog, indicating no known large\u2011scale active exploitation. Authenticated user privileges are not required; anyone who can reach the meeting page can potentially extract the key."}}}}, "created": "2025-10-27T22:10:26.730587+00:00", "updated": "2026-04-22T22:00:18.080625+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpcenter", "wpcenter$PRODUCT$eroom"]}