The vulnerability is a missing authorization flaw that allows an attacker to modify settings within the DigitalME eRoom WordPress plugin. Because the plugin’s access control is incorrectly configured, a user who would normally have no rights to change settings can alter Zoom meeting parameters and other configuration options. This flaw is classified as CWE-862, indicating a privilege escalation or bypass of authentication checks. Such unauthorized changes could grant an attacker the ability to manipulate meeting scheduling, participant access, or other sensitive behavior of the plugin without proper administrative privileges.

DigitalME eRoom, the WordPress eRoom Zoom Meetings Webinar plugin, is affected in all releases up to and including version 1.7.1. Users of any WordPress site running this plugin without updating to version 1.7.2 or later are therefore exposed.

With a CVSS score of 5.4, the vulnerability lies in the moderate range, indicating that exploitation requires some effort but is not trivial. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known large-scale exploits yet. The attack vector is likely remote via the WordPress site’s administrative interface, where an attacker logged in as a non‑admin could exploit the authorization gap to change settings. The risk is elevated for installations where the plugin’s settings page is accessible to roles other than administrators.