Hel Online Classroom
Monthly
Unauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBlueButton shared secret through an unprotected REST API route, enabling any remote attacker to retrieve stored plugin settings without credentials. With the exposed shared secret, an attacker can forge valid HMAC-signed API requests directly against the connected BigBlueButton server, allowing unauthorized access to or disruption of virtual classroom sessions. No public KEV confirmation exists, but a public exploit is available via WPScan; EPSS is low at 0.14%, consistent with the plugin's niche footprint.
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to obtain a signed meeting join link for any classroom - including those protected by an access code - and join it with moderator privileges. All WordPress sites running this plugin through version 1.0.3 are affected regardless of classroom configuration. A publicly available exploit exists via WPScan, though EPSS (0.14%, 3rd percentile) indicates limited automated exploitation activity at time of analysis; no CISA KEV confirmation of active widespread exploitation is present.
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remote attacker to redirect all classroom sessions to attacker-controlled infrastructure and replace the shared secret used to sign those sessions. Because no authentication or authorization check exists on the settings-save endpoint, the entire plugin's operational trust model - both the backend URL and the signing secret - can be silently hijacked without any credentials. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile), indicating no confirmed widespread exploitation at time of analysis.
Unauthenticated attackers can delete any classroom record in the HEL Online Classroom WordPress plugin (versions up to 1.0.3) via a REST API endpoint that bypasses all WordPress authentication checks through a permission_callback set to '__return_true', resulting in permanent data loss. The vulnerability affects the plugin's core functionality and requires only network access with no user interaction, though the CVSS score of 5.3 reflects limited confidentiality impact (integrity modification only, no information disclosure).
Unauthenticated information disclosure in the HEL Online Classroom WordPress plugin (versions ≤ 1.0.3) exposes the BigBlueButton shared secret through an unprotected REST API route, enabling any remote attacker to retrieve stored plugin settings without credentials. With the exposed shared secret, an attacker can forge valid HMAC-signed API requests directly against the connected BigBlueButton server, allowing unauthorized access to or disruption of virtual classroom sessions. No public KEV confirmation exists, but a public exploit is available via WPScan; EPSS is low at 0.14%, consistent with the plugin's niche footprint.
Unauthenticated REST API access in the HEL Online Classroom WordPress plugin (through 1.0.3) allows any remote user to obtain a signed meeting join link for any classroom - including those protected by an access code - and join it with moderator privileges. All WordPress sites running this plugin through version 1.0.3 are affected regardless of classroom configuration. A publicly available exploit exists via WPScan, though EPSS (0.14%, 3rd percentile) indicates limited automated exploitation activity at time of analysis; no CISA KEV confirmation of active widespread exploitation is present.
Unauthenticated settings overwrite in the HEL Online Classroom WordPress plugin (versions through 1.0.3) allows any remote attacker to redirect all classroom sessions to attacker-controlled infrastructure and replace the shared secret used to sign those sessions. Because no authentication or authorization check exists on the settings-save endpoint, the entire plugin's operational trust model - both the backend URL and the signing secret - can be silently hijacked without any credentials. A publicly available exploit exists via WPScan, though EPSS sits at 0.18% (7th percentile), indicating no confirmed widespread exploitation at time of analysis.
Unauthenticated attackers can delete any classroom record in the HEL Online Classroom WordPress plugin (versions up to 1.0.3) via a REST API endpoint that bypasses all WordPress authentication checks through a permission_callback set to '__return_true', resulting in permanent data loss. The vulnerability affects the plugin's core functionality and requires only network access with no user interaction, though the CVSS score of 5.3 reflects limited confidentiality impact (integrity modification only, no information disclosure).