A missing capability check on a REST API endpoint allows any caller to delete classroom records by supplying an ID in the request. The endpoint’s permission_callback is set to a generic true return, which bypasses WordPress authentication and authorization. The result is permanent loss of classroom data, disrupting teaching and learning activities. This flaw is a classic missing authorization vulnerability identified as CWE-862.

The vulnerable component is the HEL Online Classroom: AI‑powered Online Classrooms WordPress plugin, higheredlab. All releases up to and including version 1.0.3 are affected. Affected users are site owners hosting the plugin on a WordPress installation where the REST API is exposed.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an unauthenticated HTTP request to the plugin’s REST endpoint; the attacker only needs to provide a classroom ID, a value that is easy to discover or enumerate. Because authentication is bypassed, the exploit can be attempted from any network with access to the site, making the risk moderate but potentially widespread if the site is publicly reachable.