CVE-2026-77007
Low risk· EPSS 4%Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes. This allows unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.
Risk Assessment
Exposure of the shared secret may allow an attacker to impersonate the server and manipulate BigBlueButton sessions, potentially leading to unauthorized access to meetings.
Recommendation
Update the plugin to the latest version if available, or temporarily disable the REST API route that exposes settings. Additionally, change the shared secret and monitor logs for unauthorized requests.
Other vulnerabilities in HEL Online Classroom
See all- CVE-2026-77010Low risk· EPSS 3%
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code. This allows unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
- CVE-2026-77008Low risk· EPSS 7%
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings. This allows unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.
Original NVD description (English source)
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.