CVE-2026-6708 is a missing authorization vulnerability (CWE-862) in the HEL Online Classroom WordPress plugin versions up to 1.0.3. The issue arises because a REST API endpoint uses a permission_callback set to '__return_true', effectively disabling all authentication and authorization checks. This flaw enables unauthenticated attackers to delete classroom records by supplying their IDs in API requests, resulting in permanent deletion of data. The CVSS 3.1 base score is 5.3 (medium severity), with attack vector network, low attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or vendor advisory is currently available to confirm remediation status.

An unauthenticated attacker can delete any classroom record in the HEL Online Classroom plugin, causing permanent data loss. There is no confidentiality or availability impact reported. The integrity of classroom data is compromised, which could disrupt educational activities relying on this plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the vulnerable plugin or restricting access to the affected REST API endpoints through additional access controls or firewall rules to prevent unauthorized deletion of classroom records.