CVE-2026-77008: CWE-284 Improper Access Control in HEL Online Classroom: AI-powered Online Classrooms

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through version 1.0.3 lacks authorization and authentication validation when saving its settings. This flaw enables unauthenticated attackers to overwrite configuration settings, including redirecting all online classroom sessions and modifying the shared secret used for session signing. The vulnerability is identified as CWE-284 (Improper Access Control) and has a CVSS 3.1 base score of 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and low availability impact.

An attacker can overwrite critical plugin settings without authentication, allowing them to redirect online classroom sessions to infrastructure under their control and alter the shared secret used for session signing. This can lead to integrity and availability impacts on the online classroom service. There is no direct confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the plugin settings page and monitor for unauthorized changes if possible.