CVE-2025-49919: 
WordPress vulnerability analysis and mitigation

CVE-2025-49919 is a Sensitive Data Exposure vulnerability (CWE-201: Insertion of Sensitive Information Into Sent Data) affecting the eRoom – Zoom Meetings & Webinar WordPress plugin developed by StylemixThemes (WPCenter/DigitalME). All versions up to and including 1.5.6 are affected. The vulnerability was reported by researcher Mohamad Fattyr on October 4, 2025, disclosed by Patchstack on November 26, 2025, and published to NVD on December 18, 2025. It carries a CVSS v3.1 base score of 5.8 (Medium) (Patchstack).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin inadvertently includes sensitive data in responses or transmitted data that should not be accessible to unauthenticated users. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, with a changed scope indicating the impact extends beyond the vulnerable component itself. The vulnerability allows an attacker to retrieve embedded sensitive data — such as API keys, credentials, or configuration details — that are exposed in plugin-generated output (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to retrieve sensitive information that is normally restricted from regular users, such as Zoom API credentials or integration secrets embedded in the plugin's output. While the confidentiality impact is rated Low and there is no direct integrity or availability impact, exposed credentials could be leveraged to access connected Zoom accounts, conduct further attacks, or exploit other weaknesses in the system. The changed scope indicates the exposure may affect resources beyond the WordPress installation itself, such as third-party Zoom services (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

The vendor (StylemixThemes) has released version 1.5.7 of the eRoom – Zoom Meetings & Webinar plugin, which patches this vulnerability. Site administrators should update to version 1.5.7 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, consult your hosting provider or web developer for assistance (Patchstack).

Wordfence referenced this vulnerability in their weekly WordPress vulnerability intelligence report for the period of November 24–30, 2025. Patchstack, which coordinated the disclosure through its Active VDP program, classifies the priority as Low with no impactful threat currently observed. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified.