CVE-2026-77008 — HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update

CVE-2026-77008

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update PUBLISHED

Description (CNA)

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.

Affected (CNA)

Vendor / product	Versions
Unknown / HEL Online Classroom: AI-powered Online Classrooms	affected 0 through 1.0.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/529663a1-87ed-4cff-92f5-85641e9718b3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.