CVE-2026-77008

CVE-2026-77008 affects the HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through version 1.0.3 . The root cause is a missing authentication/authorization check on the plugin's settings-saving endpoint, allowing any unauthenticated user to overwrite the stored configuration. ...

CVE-2026-77008 HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions...