Threat database

Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.

CVE-2026-62038 is a high-severity authentication bypass vulnerability affecting DigitalME eRoom versions up to 1.7.1. It allows unauthenticated attackers to bypass authentication mechanisms, potentially leading to unauthorized access with limited confidentiality, integrity, and availability impact. No specific affected versions beyond <=1.7.1 are provided. There is no information on available patches or vendor advisories. The vulnerability is identified as CWE-288, indicating broken authentication via an alternate path or channel.

Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

Contributor SQL Injection in eRoom <= 1.7.1 versions.

Insertion of Sensitive Information Into Sent Data vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Retrieve Embedded Sensitive Data.This issue affects eRoom: from n/a through <= 1.5.6.

The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting view template. This makes it possible for unauthenticated attackers to extract the sdk_secret value, which should remain server-side, compromising the security of the Zoom integration and allowing attackers to generate valid JWT signatures for unauthorized meeting access.

The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.18 via the search_posts function. This makes it possible for authenticated attackers, with subscriber access and higher, to obtain post excerpts including those of draft and pending posts.