CVE-2026-77008
Low risk· EPSS 7%Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings. This allows unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.
Risk Assessment
An attacker can take control of all online sessions by redirecting them to their own infrastructure, potentially leading to data interception and integrity breaches of meetings.
Recommendation
Update the plugin to the latest version if available, or remove it if not essential. Additionally, restrict access to the admin panel and monitor changes to plugin settings.
Other vulnerabilities in HEL Online Classroom
See all- CVE-2026-77010Low risk· EPSS 3%
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code. This allows unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
- CVE-2026-77007Low risk· EPSS 4%
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes. This allows unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.
Original NVD description (English source)
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.