Descripción
The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This due the exposing Zoom SDK secret keys client-side JavaScript within meeting view template. makes it possible unauthenticated attackers extract sdk_secret value, which should remain server-side, compromising security integration allowing generate valid JWT signatures unauthorized access.
https://plugins.trac.wordpress.org/browser/eroom-zoom-meetings-webinar/tags/1.5.6/templates/single/meeting_view.php#L173
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3379064 40eroom-zoom-meetings-webinar 2Ftrunk&old=3375935 40eroom-zoom-meetings-webinar 2Ftrunk&sfp_email=&sfph_mail=#file4
https://www.wordfence.com/threat-intel/vulnerabilities/id/0baaa6b7-3884-465e-bae3-46edab6312d4?source=cve
