The HEL Online Classroom WordPress plugin (versions up to 1.0.3) fails to enforce authorization on its REST API endpoints and inconsistently checks the per‑class access code, allowing any visitor to request a signed meeting join link and then join the class with moderator privileges. This flaw effectively grants an unauthenticated attacker full control over a class session, enabling disruption, eavesdropping, or manipulation of the learning experience.

The vulnerability affects installations of the HEL Online Classroom: AI‑powered Online Classrooms plugin for WordPress running version 1.0.3 or earlier. No other products or versions were identified as impacted by the corresponding CNA.

The lack of authorization checks makes the flaw highly exploitable from anywhere over the internet via simple REST API calls. No EPSS score is available, but the absence of an exploitation patch in the vendor's official advisories indicates a high likelihood that attackers could leverage this flaw before a fix is applied. The vulnerability is not listed in CISA’s KEV catalog, yet its potential to compromise entire class sessions warrants urgent remediation.