eRoom vulnerabilities

The eRoom plugin by DigitalME, versions up to 1.7.1, contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The DigitalME eRoom plugin (eroom-zoom-meetings-webinar) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects eRoom versions up to and including 1.7.1.

Unauthenticated Broken Authentication in the eRoom plugin up to version 1.7.1. An attacker can bypass authentication mechanisms and gain unauthorized access.

The eRoom plugin versions up to 1.7.1 contain a broken access control vulnerability, allowing subscribers unauthorized access to functions reserved for higher roles.

The eRoom plugin version 1.7.1 and earlier contains an SQL Injection vulnerability exploitable by users with Contributor role.