EUVD-2026-68056
GHSA-983m-53wm-75ww
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Fully network-exploitable with no prerequisites; confidentiality and integrity both low-impact, scoped to classroom feature; no availability impact identified.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.
AnalysisAI
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to obtain a signed meeting join link for any classroom - including those protected by an access code - and join it with moderator privileges. All WordPress sites running this plugin through version 1.0.3 are affected regardless of classroom configuration. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network access to a WordPress site with the plugin installed and active through version 1.0.3. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) captures a no-barrier, fully remote, unauthenticated exploitation path with moderate impact - but the base score arguably undersells the integrity impact, since gaining moderator privileges within an educational session enables class disruption, content exposure, and participant manipulation beyond what 'I:L' typically conveys. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No patched version is confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hel Online Classroom
View allUnauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBl
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remo
Unauthenticated attackers can delete any classroom record in the HEL Online Classroom WordPress plugin (versions up to 1
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today