plugin

Hel Online Classroom Vulnerabilities

4 known security issues reported for the Hel Online Classroom WordPress plugin. Most recent disclosed Aug 31, 2026.

1 high 3 medium

Running Hel Online Classroom on your site? Check whether your installed version is affected.

Scan your site free

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure

medium

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:
5.3
(Wordfence)
Affected:
up to 1.0.3
Fix:
No patched version reported
Disclosed:
Aug 31, 2026

CVE-2026-77010 on NVD →

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure

medium

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:
5.3
(Wordfence)
Affected:
up to 1.0.3
Fix:
No patched version reported
Disclosed:
Aug 29, 2026

CVE-2026-77007 on NVD →

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Settings Update

high

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to update plugin settings.

CVSS:
7.3
(Wordfence)
Affected:
up to 1.0.3
Fix:
No patched version reported
Disclosed:
Aug 27, 2026

CVE-2026-77008 on NVD →

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter

medium

The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permission_callback of '__return_true', which bypasses all WordPress authenti...

CVSS:
5.3
(Wordfence)
Affected:
up to 1.0.3
Fix:
No patched version reported
Disclosed:
May 11, 2026

CVE-2026-6708 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database