The vulnerability arises from the eRoom plugin inserting sensitive data directly into data sent to clients. An attacker can retrieve this embedded sensitive information when interacting with the plugin's interfaces, potentially exposing credentials or personal data. This is a classic information disclosure flaw (CWE‑201) that compromises confidentiality.

The issue covers DigitalME's eRoom WordPress plugin versions up to and including 1.5.6. Any WordPress installation that has the eRoom Zoom Meetings & Webinars plugin of version 1.5.6 or earlier is affected. No specific operating system or server version is mentioned, so the vulnerability applies to all environments where the plugin is in use.

The CVSS score of 5.8 indicates a moderate severity, and the EPSS score of less than 1% suggests the likelihood of exploitation is low. The vulnerability is not currently listed in the CISA KEV catalog, meaning it has not yet been linked to known exploit activity. The attack vector is likely remote; a threat actor can trigger the disclosure by accessing the plugin's public-facing endpoints or by sending crafted requests from a remote host.