Junglewise Threat Intelligence

CVE-2026-6708: HEL Online Classroom WordPress plugin missing authorization in REST API

CVE-2026-6708 · Severity: medium · CVSS 5.3 · Published 2026-05-12

Executive brief

The HEL Online Classroom plugin for WordPress, which provides AI-powered virtual classroom features, contains a security flaw that allows unauthorized users to delete classroom records. An attacker can exploit this to permanently remove classroom data without needing any login credentials. This could lead to significant data loss and disruption of online educational activities.

Technical details

The HEL Online Classroom plugin for WordPress is vulnerable to missing authorization (CWE-862) in versions up to and including 1.0.3. The vulnerability exists because a REST API endpoint is registered with a 'permission_callback' set to '__return_true', effectively bypassing WordPress's built-in authentication and authorization mechanisms. An unauthenticated remote attacker can send a crafted request to this endpoint with a specific classroom ID to trigger the deletion of that record. This results in permanent data loss within the plugin's classroom management system.

Affected products

  • HEL Online Classroom HEL Online Classroom: AI-powered Online Classrooms Up to and including 1.0.3

Timeline

  • 2026-05-12: disclosed: CVE published by Wordfence and NVD

References