CVE-2026-77007: CWE-200 Information Exposure in HEL Online Classroom: AI-powered Online Classrooms

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through version 1.0.3 contains an information exposure vulnerability (CWE-200) due to missing authorization checks on one of its REST API endpoints. This flaw permits unauthenticated users to retrieve sensitive stored settings, notably the shared secret used to sign API requests to the integrated BigBlueButton server. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity, with network attack vector, no privileges required, and no user interaction needed. No official patch or remediation guidance has been published as of the data provided.

An attacker can access sensitive configuration data, including the shared secret for API request signing, without authentication. This could compromise the integrity of communications with the BigBlueButton server or allow unauthorized API interactions. The vulnerability does not impact availability or integrity directly but exposes confidential information that could facilitate further attacks.

No official fix or patch is currently available. Users should monitor the vendor's advisory channels for updates. Until a patch is released, restricting access to the REST API endpoints via web server or firewall rules may reduce exposure. Avoid exposing the plugin's REST API to untrusted networks where possible.