CVE-2026-114176
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The DigitalME eRoom plugin (eroom-zoom-meetings-webinar) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects eRoom versions up to and including 1.7.1.
Risk Assessment
An attacker could access functionality or data they are not authorized to use, potentially leading to unauthorized actions on the site. The risk applies to organizations using this WordPress plugin.
Recommendation
Update the eRoom plugin to the latest version available from the vendor. If updating is not possible, consider disabling the plugin until a fix is released.
Other vulnerabilities in eRoom
See all- CVE-2026-114175Medium
The eRoom plugin by DigitalME, versions up to 1.7.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.
- CVE-2026-62038High
Unauthenticated Broken Authentication in the eRoom plugin up to version 1.7.1. An attacker can bypass authentication mechanisms and gain unauthorized access.
- CVE-2026-25427Medium
The eRoom plugin versions up to 1.7.1 contain a broken access control vulnerability, allowing subscribers unauthorized access to functions reserved for higher roles.
- CVE-2026-25405High
The eRoom plugin version 1.7.1 and earlier contains an SQL Injection vulnerability exploitable by users with Contributor role.
Original NVD description (English source)
Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS