HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
medium
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
- CVSS:
- 5.3
(Wordfence)
- Affected:
- up to 1.0.3
- Fix:
- No patched version reported
- Disclosed:
- Aug 31, 2026
CVE-2026-77010 on NVD →
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
medium
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.
- CVSS:
- 5.3
(Wordfence)
- Affected:
- up to 1.0.3
- Fix:
- No patched version reported
- Disclosed:
- Aug 29, 2026
CVE-2026-77007 on NVD →
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Settings Update
high
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to update plugin settings.
- CVSS:
- 7.3
(Wordfence)
- Affected:
- up to 1.0.3
- Fix:
- No patched version reported
- Disclosed:
- Aug 27, 2026
CVE-2026-77008 on NVD →
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter
medium
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permission_callback of '__return_true', which bypasses all WordPress authenti...
- CVSS:
- 5.3
(Wordfence)
- Affected:
- up to 1.0.3
- Fix:
- No patched version reported
- Disclosed:
- May 11, 2026
CVE-2026-6708 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database