CVE-2026-6708 is a missing authorization vulnerability (CWE-862) in the HEL Online Classroom WordPress plugin versions up to 1.0.3. The issue arises because a REST API endpoint is registered with a permission_callback set to '__return_true', effectively disabling all WordPress authentication and authorization checks for that endpoint. This flaw enables unauthenticated attackers to delete classroom records by providing the record ID in the request, resulting in permanent data loss. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.3 (Network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, integrity impact, no availability impact). No patch or official fix has been published yet.

Unauthenticated attackers can delete classroom records in the affected plugin, causing permanent loss of data integrity. There is no impact on confidentiality or availability reported. The vulnerability could disrupt classroom management by removing critical records without authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the WordPress REST API endpoints related to the plugin where possible, and monitor for suspicious requests targeting classroom record deletions. Avoid exposing the plugin's REST API to untrusted networks. No official patch or temporary fix has been published by the vendor at this time.