EUVD-2026-68055
GHSA-hv52-q9g7-xc97
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Overwriting signing secrets and redirecting all classroom sessions to attacker infrastructure constitutes high integrity impact with scope change affecting downstream session participants.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.
AnalysisAI
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remote attacker to redirect all classroom sessions to attacker-controlled infrastructure and replace the shared secret used to sign those sessions. Because no authentication or authorization check exists on the settings-save endpoint, the entire plugin's operational trust model - both the backend URL and the signing secret - can be silently hijacked without any credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the target WordPress site having the HEL Online Classroom plugin installed and active in a version at or below 1.0.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, score 6.5) materially understates real-world impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No explicitly confirmed patched release version is present in the available data - administrators should immediately check the WordPress plugin repository for any release beyond 1.0.3 before assuming a fix is available; upstream fix availability is referenced via the WPScan advisory (https://wpscan.com/vulnerability/529663a1-87ed-4cff-92f5-85641e9718b3/) but a released patched version has not been independently confirmed at time of this analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hel Online Classroom
View allUnauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBl
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to o
Unauthenticated attackers can delete any classroom record in the HEL Online Classroom WordPress plugin (versions up to 1
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today