The eRoom plugin for WordPress suffers from a missing authorization check (CWE-862) in its search_posts function. This flaw permits authenticated users with subscriber privileges or higher to access post excerpts, including those of draft and pending posts, which should normally be restricted. The vulnerability is present in all versions up to 1.4.18. The CVSS 3.1 base score is 4.3, reflecting a medium impact primarily due to information disclosure without integrity or availability impact. No known exploits in the wild have been reported, and no patch or official fix has been documented.

An attacker with subscriber-level access can obtain sensitive information from draft and pending posts that are not intended to be publicly accessible. This exposure could lead to leakage of confidential content or internal communications. There is no impact on data integrity or availability. The vulnerability does not allow remote unauthenticated access; the attacker must be authenticated with at least subscriber privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and consider limiting the use of the affected plugin. Monitor for updates from the vendor or plugin maintainers regarding patches or official mitigations.