CVE-2023-3947
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk24th percentile — higher than 24% of all known CVEs
Summary
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This allows unauthenticated attackers to decrypt and view the meeting id and password.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive information, potentially leading to breaches of user privacy and data security.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability and review system security to protect against potential attacks.
Original NVD description (English source)
The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.