The eRoom – Webinar & Meeting Plugin for WordPress contains a flaw that exposes Zoom SDK secret keys in client‑side JavaScript within the meeting view template. A malicious actor who can access a meeting page can read the embedded sdk_secret value, an element that should remain on the server. With this secret the attacker can forge valid JSON Web Tokens, enabling intrusion into any Zoom meeting linked to the plugin and compromising both confidentiality and integrity of the meeting content.

This issue affects all installations of digitalmeactivecampaign’s eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams up to and including version 1.5.6. WordPress sites that have recent plugin versions but have not applied the fix are at risk.

The CVSS score of 5.3 indicates a medium impact when measured against the exposed secret, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, indicating no known large‑scale active exploitation. Authenticated user privileges are not required; anyone who can reach the meeting page can potentially extract the key.