CVE-2023-3947

CVE-2023-3947 affects the Video Conferencing with Zoom plugin for WordPress, specifically versions up to and including 4.2.1. This vulnerability, categorized as Sensitive Information Exposure, stems from a hardcoded encryption key within the 'vczapi_encrypt_decrypt' function. Unauthenticated attackers can exploit this to decrypt and view sensitive meeting IDs and passwords. The CVSS score of 5.3 (MEDIUM) indicates a network-based attack with low complexity, requiring no user interaction, and resulting in low confidentiality impact. While the EPSS and FAUCET scores are low, signifying a lower immediate risk, the potential for unauthorized access to meeting credentials remains. Currently, there is no evidence of active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention.