CVE-2026-77010: HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass

Q: Who can exploit this issue?

Any unauthenticated user who can reach the plugin's REST API routes may be able to exploit it. No WordPress account or prior authorization is described as necessary.

Q: Are classrooms protected by an access code still exposed?

Yes. The affected plugin does not consistently enforce the per-class access code, and an unauthenticated user may obtain a signed join link for a classroom even when it is access-code protected.

Q: What level of meeting access could an attacker obtain?

An attacker may join an affected classroom using moderator privileges, rather than only participant-level access.

Q: Which plugin versions are affected?

The issue affects HEL Online Classroom: AI-powered Online Classrooms through version 1.0.3.

Published Aug 29, 2026

Updated

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.

Affected Software

1 affected component

WordPress HEL Online Classroom: AI-powered Online Classrooms<=1.0.3

Event History

Aug 29, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated user who can reach the plugin's REST API routes may be able to exploit it. No WordPress account or prior authorization is described as necessary.

Are classrooms protected by an access code still exposed?

Yes. The affected plugin does not consistently enforce the per-class access code, and an unauthenticated user may obtain a signed join link for a classroom even when it is access-code protected.

What level of meeting access could an attacker obtain?

An attacker may join an affected classroom using moderator privileges, rather than only participant-level access.

Which plugin versions are affected?

The issue affects HEL Online Classroom: AI-powered Online Classrooms through version 1.0.3.

CVE-2026-77010: HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are classrooms protected by an access code still exposed?

What level of meeting access could an attacker obtain?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are classrooms protected by an access code still exposed?

What level of meeting access could an attacker obtain?

Which plugin versions are affected?