Executive brief
The HEL Online Classroom WordPress plugin, used by educational institutions to run virtual classrooms, fails to verify user permissions on its REST API endpoints. An attacker can bypass access codes and obtain moderator privileges in any classroom without authentication, enabling unauthorized access to sensitive classroom sessions and the ability to control them.
Technical details
The vulnerability is an improper access control issue (CWE-284) in the plugin's REST API routes. The plugin fails to perform authorization checks and does not consistently enforce per-classroom access codes, allowing unauthenticated attackers to call API endpoints that generate signed meeting join links with moderator privileges. The attack requires only network access to the WordPress site hosting the vulnerable plugin; no authentication or user interaction is required. An attacker can enumerate classrooms and obtain moderator join links for any classroom, including those protected by access codes, leading to unauthorized classroom access and control.
Affected products
- HEL Online Classroom: AI-powered Online Classrooms through 1.0.3
Timeline
- 2026-08-27: disclosed
- 2026-08-29: advisory