What’s Vulnerable › Vulnerabilities
CVE-2026-77010: HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-29 · updated 2026-08-31
- Weakness: CWE-284
Description
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
Affected products
- HEL Online Classroom: AI-powered Online Classrooms: through 1.0.3
References
Get alerted when CVE-2026-77010 or the next vulnerability affects your stack