CVE-2026-77008: HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update

Q: Who can exploit this issue?

Any unauthenticated remote user can exploit it. No login or WordPress account is required to save replacement plugin settings.

Q: What can an attacker change?

An attacker can overwrite the plugin's settings, repoint every online classroom to infrastructure they control, and replace the shared secret used to sign sessions.

Q: Are default deployments affected?

The issue is described as missing authentication and authorization checks when settings are saved, so deployments using the affected plugin through version 1.0.3 are exposed through that settings-saving functionality.

Published Aug 29, 2026

Updated

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.

Affected Software

1 affected component

WordPress HEL Online Classroom: AI-powered Online Classrooms<=1.0.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress HEL Online Classroom: AI-powered Online Classrooms to a version that resolves this vulnerability.
Fixed in 1.0.3
Compensating control
Restrict access to the WordPress admin/REST endpoints that save plugin settings so only authenticated administrators can modify plugin configuration (mitigate unauthenticated settings overwrite until the plugin is upgraded).

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote user can exploit it. No login or WordPress account is required to save replacement plugin settings.

What can an attacker change?

An attacker can overwrite the plugin's settings, repoint every online classroom to infrastructure they control, and replace the shared secret used to sign sessions.

Are default deployments affected?

The issue is described as missing authentication and authorization checks when settings are saved, so deployments using the affected plugin through version 1.0.3 are exposed through that settings-saving functionality.

CVE-2026-77008: HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Are default deployments affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Are default deployments affected?