Skip to content
Sign in
6.5 Medium

CVE-2026-77008 The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or…

Description

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.

Affected products and versions

Product Affected versions Fixed in
HEL Online Classroom: AI-powered Online Classrooms 1.0 earliest → 1.0.3 No fix stated

Other CVEs of HEL Online Classroom: AI-powered Online Classrooms

The 3 CVEs of HEL Online Classroom: AI-powered Online Classrooms →
CVE-2026-77010 The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation… 6.5 Medium CVE-2026-77007 The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation… 7.5 High
Track this CVE