The Video Conferencing with Zoom plugin for WordPress contains a missing authorization vulnerability (CWE-862) in the get_assign_host_id AJAX action. Authenticated attackers with subscriber or higher privileges can exploit this flaw to enumerate sensitive user information such as usernames, emails, and user IDs across the site. The vulnerability affects all plugin versions up to and including 4.4.5. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity and requiring low privileges but no user interaction. There is no indication of known exploits in the wild or an available patch from the vendor.

An attacker with subscriber-level access can retrieve sensitive user information including usernames, emails, and user IDs from the affected WordPress site. This information disclosure can lead to privacy violations and potentially facilitate further targeted attacks such as phishing or social engineering. The vulnerability does not affect system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access where possible and monitor for suspicious activity involving user enumeration. Avoid granting unnecessary privileges to users and consider disabling or replacing the plugin if sensitive information exposure is a concern.