CVE-2025-11760 Overview
CVE-2025-11760 affects the eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams for WordPress. All versions up to and including 1.5.6 expose Zoom SDK secret keys in client-side JavaScript within the meeting view template. Unauthenticated attackers can extract the sdk_secret value directly from rendered HTML sent to any visitor.
The leaked secret allows attackers to generate valid JWT signatures for the Zoom integration. This enables unauthorized meeting access and impersonation within the affected Zoom application context. The flaw is classified as sensitive information exposure [CWE-200].
Critical Impact
Unauthenticated remote attackers can retrieve the Zoom SDK secret from any page rendering the meeting view, then forge JWTs to access or manipulate Zoom meetings tied to the site's integration.
Affected Products
- eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams (WordPress plugin)
- All plugin versions up to and including 1.5.6
- Sites using the plugin's Zoom integration with configured SDK credentials
Discovery Timeline
- 2025-10-25 - CVE-2025-11760 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11760
Vulnerability Analysis
The eRoom plugin renders the Zoom meeting interface through the template file templates/single/meeting_view.php. At line 173 of the vulnerable release, the plugin injects the Zoom SDK secret directly into inline JavaScript delivered to the browser. Any visitor loading a page that includes this template receives the secret in the HTTP response body.
The SDK secret is intended to remain server-side and to sign JWT tokens used by the Zoom Web SDK. Placing it in client-side code eliminates the trust boundary between the server and untrusted clients. An attacker only needs to view page source or issue an unauthenticated HTTP GET request to retrieve the value.
Once the attacker holds the sdk_secret and the paired sdk_key, they can generate valid JWT signatures locally. These signatures authorize the attacker to join, start, or manipulate Zoom sessions bound to the site's Zoom application credentials.
Root Cause
The root cause is improper separation of client-side and server-side secrets. The developer passed the SDK secret through to the template rendering layer instead of restricting JWT signing to server-side code paths. The design violates the principle that secrets used for signing must never appear in code delivered to the browser.
Attack Vector
Exploitation requires no authentication, no user interaction, and no elevated privileges. An attacker sends a network request to a WordPress site running the vulnerable plugin and parses the returned HTML for the embedded sdk_secret string. The attack works against any publicly reachable page that renders the meeting view template.
See the WordPress Template File for the specific location of the exposed value, and the Wordfence Vulnerability Analysis for additional context.
Detection Methods for CVE-2025-11760
Indicators of Compromise
- Presence of the string sdk_secret in HTML responses from pages rendering the eRoom meeting view template
- Unexpected Zoom meeting joins, starts, or configuration changes tied to the site's Zoom SDK application
- Outbound requests from unknown clients to Zoom API endpoints using JWTs signed with the leaked key
Detection Strategies
- Crawl WordPress sites for pages served by the eRoom plugin and inspect response bodies for embedded SDK credentials
- Query the WordPress plugin registry to enumerate installations of eroom-zoom-meetings-webinar at version 1.5.6 or earlier
- Review Zoom application audit logs for JWT-authenticated actions originating from IP addresses outside expected server ranges
Monitoring Recommendations
- Alert on any HTTP response from the WordPress site that contains high-entropy strings matching the SDK secret format
- Monitor Zoom SDK app activity for anomalous session creation patterns, especially outside business hours
- Track plugin version changes through file integrity monitoring on the WordPress wp-content/plugins/eroom-zoom-meetings-webinar/ directory
How to Mitigate CVE-2025-11760
Immediate Actions Required
- Update the eRoom plugin to a version later than 1.5.6 that removes the SDK secret from client-side output
- Rotate the Zoom SDK key and secret in the Zoom Marketplace app configuration to invalidate any previously leaked credentials
- Audit Zoom meeting logs for unauthorized access that may have occurred while the vulnerable version was deployed
Patch Information
The vendor addressed the issue in a plugin update. Refer to the WordPress Changeset Update for the specific code change that removes the exposed secret from the meeting view template.
Workarounds
- Deactivate the eRoom plugin until an update can be applied if patching is not immediately possible
- Restrict access to pages that render the meeting view template using authentication or IP allowlisting
- Revoke the affected Zoom SDK application and issue new credentials scoped only to server-side use
# Update the eRoom plugin via WP-CLI
wp plugin update eroom-zoom-meetings-webinar
# Verify the installed version is above 1.5.6
wp plugin get eroom-zoom-meetings-webinar --field=version
# If a fixed version is not yet available, deactivate the plugin
wp plugin deactivate eroom-zoom-meetings-webinar
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
