Description
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
Published: 2026-08-29
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized moderator access and class takeover
Action: Immediate Patch
AI Analysis

Impact

The HEL Online Classroom: AI‑powered Online Classrooms WordPress plugin up to version 1.0.3 fails to enforce authorization on its REST API endpoints and consistently checks the per‑class access code. This flaw allows any visitor to request a signed meeting join link and then join the class with moderator privileges, effectively granting an unauthenticated attacker full control over the session.

Affected Systems

The vulnerability affects installations of the HEL Online Classroom: AI‑powered Online Classrooms plugin for WordPress running version 1.0.3 or earlier. No other products or versions were identified as impacted by the corresponding CNA.

Risk and Exploitability

The lack of authorization checks makes the flaw highly exploitable from any location over the internet via simple REST API calls. The EPSS score is < 1% and the CVSS score of 6.5 indicates a moderate‑severe risk. The vulnerability is not listed in CISA’s KEV catalog, but the potential to compromise entire class sessions warrants urgent remediation.

Generated by OpenCVE AI on August 30, 2026 at 02:52 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the HEL Online Classroom plugin to the latest release that implements proper authorization and access‑code enforcement.
  • Restrict or disable the vulnerable REST API endpoints, ensuring that only authenticated and authorized users can generate join links.
  • Implement server‑side validation to confirm moderator privileges and enforce per‑class access codes before issuing a join link or allowing participation.
  • Monitor WordPress and plugin logs for unusual REST API activity and unauthorized join attempts.

Generated by OpenCVE AI on August 30, 2026 at 02:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Higheredlab
Higheredlab hel Online Classroom: Ai-powered Online Classrooms
Wordpress
Wordpress wordpress
Vendors & Products Higheredlab
Higheredlab hel Online Classroom: Ai-powered Online Classrooms
Wordpress
Wordpress wordpress

Sun, 30 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 29 Aug 2026 08:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Sat, 29 Aug 2026 06:15:00 +0000

Type Values Removed Values Added
Description The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
Title HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass
References

Subscriptions

Higheredlab Hel Online Classroom: Ai-powered Online Classrooms
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-08-30T00:56:51.517Z

Reserved: 2026-08-20T07:38:32.430Z

Link: CVE-2026-77010

cve-icon Vulnrichment

Updated: 2026-08-30T00:48:53.181Z

cve-icon NVD

Status : Deferred

Published: 2026-08-29T06:17:39.037

Modified: 2026-08-31T20:14:36.250

Link: CVE-2026-77010

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-01T12:45:12Z

Weaknesses