Description

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-29T06:17:34.453Z",
  "pubdate": "2026-08-29T06:17:34.453Z",
  "executiveSummary": "The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin, versions 1.0.3 and below, contains a critical security vulnerability involving improper authorization for its REST API routes.\nThis flaw allows unauthenticated remote attackers to query specific API endpoints and retrieve sensitive configuration data stored within the WordPress database.\nThe primary risk stems from the unauthorized exposure of the shared secret key utilized for signing requests between the WordPress installation and the integrated BigBlueButton server.\nBy bypassing access controls, an adversary can obtain this cryptographic key, which effectively compromises the integrity and authenticity of communication between the plugin and the BigBlueButton infrastructure.\nThe vulnerability requires no authentication or special privileges, making it easily exploitable by any network-adjacent attacker. Successful exploitation allows for the potential impersonation of the WordPress site in API calls to the BigBlueButton server, leading to unauthorized classroom management, data manipulation, or complete disruption of the integrated classroom environment.\nImmediate remediation is necessary to prevent unauthorized information disclosure and maintain the security posture of the integrated platform.",
  "technicalDetails": "The vulnerability resides within the REST API controller implementation of the HEL Online Classroom: AI-powered Online Classrooms plugin. The root cause is a failure to implement mandatory permission callbacks, specifically the 'permission_callback' argument, during the registration of the affected REST API route.\nIn WordPress plugin development, the 'register_rest_route' function accepts an array of arguments that should include a capability check to ensure that only authorized users—typically those with 'manage_options' or equivalent administrative permissions—can access sensitive plugin data. Due to an implementation oversight, the plugin fails to define or enforce this authorization check for endpoints designed to serve internal plugin settings.\nThe attack flow proceeds as follows: 1) The attacker identifies the exposed REST API route provided by the plugin. 2) The attacker sends a crafted GET request to the specific endpoint via the public-facing WordPress REST API interface (typically found at /wp-json/hel-online-classroom/v1/). 3) Because the server-side code lacks authentication validation, the application processes the request, retrieves the plugin's 'options' table entry from the WordPress database, and returns the configuration array to the requester in a JSON-encoded response.\nThe resulting data exposure includes the 'bbb_secret' or equivalent shared cryptographic key required to calculate checksums for API requests sent to the BigBlueButton server. The BigBlueButton API relies on these shared secrets to verify the origin and legitimacy of requests. Possession of this key allows an attacker to bypass legitimate application logic and craft arbitrary, authenticated commands that the BigBlueButton server will treat as coming from the trusted WordPress plugin instance.\nThe vulnerability affects all versions up to 1.0.3. The exposure is total within the context of the plugin's configuration; there are no requirements for user accounts or session tokens. The attack surface is the entire network reachable to the web server's WordPress installation. Post-exploitation impact is severe, as the attacker can manipulate online classrooms, join restricted sessions as an administrator, or terminate ongoing meetings, depending on the capabilities exposed by the BigBlueButton API and the specific implementation within the plugin."
}