CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.
Explanation of Vulnerability in Simple Terms
A third-party video conferencing integration in j_3rk's product exposes limited sensitive information through network access. The vulnerability requires specific conditions to exploit and does not allow modification or disruption of service. Versions up to 4.2.1 are affected. Update to a version newer than 4.2.1 to remediate.
What an attacker can do
Read limited sensitive information from the application over the network.
Potential impact on your site
Sensitive data may be exposed to unauthenticated network-based attackers under specific conditions.
Conditions required to exploit
Network access and specific attack conditions; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
