Authorization Bypass in HEL Online Classroom Plugin by WordPress
CVE-2026-77010
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 29 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-77010?
The HEL Online Classroom plugin for WordPress prior to version 1.0.3 lacks proper authorization checks on its REST API routes. This oversight permits unauthenticated users to acquire a signed join link for any classroom, even those secured with an access code. Such vulnerabilities allow unauthorized individuals to join online classes with moderator privileges, posing significant risks to classroom content security and integrity.
Affected Version(s)
HEL Online Classroom: AI-powered Online Classrooms 0 <= 1.0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.