Executive brief
The HEL Online Classroom WordPress plugin allows anyone on the internet to change plugin settings without logging in. An attacker can redirect all online classrooms to malicious servers and steal the cryptographic secrets used to secure classroom sessions, enabling session hijacking and complete takeover of the platform's virtual classroom infrastructure.
Technical details
The vulnerability is a broken access control flaw (CWE-284) in the plugin's settings update functionality. The plugin fails to implement any authentication or authorization checks on the settings save endpoint, allowing unauthenticated network-accessible requests to modify configuration. An attacker can craft HTTP requests to overwrite critical plugin settings, including the endpoint URLs for online classrooms and their associated shared secrets (symmetric keys used for session signing). With knowledge of the shared secret, an attacker can forge valid session tokens and impersonate any user in any classroom. No patch is currently available as of the advisory publication date.
Affected products
- HEL Online Classroom: AI-powered Online Classrooms through 1.0.3
Timeline
- 2026-08-27: disclosed
- 2026-08-29: advisory