CVE-2026-114175: WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability

Q: What level of access does an attacker need?

The issue has a low-privileges-required vector (PR:L), so exploitation requires an authenticated account with some level of access. No user interaction is required.

Q: What is the likely impact if exploited?

The vulnerability can allow unauthorized settings changes. The supplied severity vector indicates low integrity and availability impact, with no confidentiality impact.

Q: Which installations may be affected?

DigitalME eRoom installations running versions through 1.7.1 are affected. The available data does not identify any unaffected fixed version.

Published Oct 22, 2026

Updated

Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.

Affected Software

1 affected component

DigitalME eRoom<=1.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress eRoom plugin to a version that resolves this vulnerability.
Fixed in 1.7.2

Event History

Oct 22, 2026

CVE Published

via MITRE·06:48 AM

Data Sourced

via MITRE·06:48 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The issue has a low-privileges-required vector (PR:L), so exploitation requires an authenticated account with some level of access. No user interaction is required.

What is the likely impact if exploited?