Description

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-29T06:17:38.927Z",
  "pubdate": "2026-08-29T06:17:38.927Z",
  "executiveSummary": "The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (versions 1.0.3 and below) contains a critical security vulnerability involving the lack of authorization and authentication checks for its settings-saving functionality.\nThis vulnerability allows any unauthenticated remote attacker to modify the plugin configuration parameters without requiring elevated privileges or valid administrative credentials.\nThe impact of this flaw is significant, as it enables the redirection of all active online classrooms to attacker-controlled infrastructure.\nBy compromising the shared secret used for session signing, an attacker can facilitate full impersonation and compromise the integrity of the classroom environment.\nThis vulnerability poses a severe risk to organizational data and classroom privacy, effectively allowing for man-in-the-middle attacks or full redirection of user traffic.\nExploitation requires no prior authentication, making it trivial for remote adversaries to weaponize the vulnerability via standard HTTP requests targeting the plugin's configuration endpoint.",
  "technicalDetails": "The vulnerability resides in the HEL Online Classroom plugin's request handling mechanism responsible for persisting settings to the database. The root cause is the total absence of access control checks, specifically missing 'is_admin()' or 'current_user_can()' capability verification, within the function or action hooked to the settings save process.\nBecause the plugin fails to validate the requester's identity or authorization status before executing the update operation, it exposes the settings object to external manipulation via HTTP POST requests.\nThe attack flow proceeds as follows: 1) An attacker identifies the plugin's settings update endpoint or the administrative hook used for parameter submission. 2) The attacker crafts a malicious request containing modified configuration parameters, specifically targeting the server destination URL and the cryptographically sensitive shared secret used for HMAC-based session validation.\nBy overwriting the 'shared secret', the attacker can generate valid session tokens or decrypt existing ones, bypassing the integrity mechanisms designed to protect student and teacher communications. 3) The malicious request is sent to the WordPress instance, which processes the update due to the lack of nonce validation or capability checks, effectively committing the attacker's configuration to the plugin's database options.\nOnce the infrastructure parameters are overwritten, all subsequent connections initiated by the plugin will point to the attacker's controlled infrastructure. This allows the attacker to intercept classroom traffic, capture sensitive session metadata, or inject arbitrary content into the virtual classroom environment.\nThe scope of this vulnerability affects versions 1.0.3 and earlier. Given that the vulnerable component operates as part of the standard WordPress plugin lifecycle, it is exposed to any network-accessible endpoint that triggers the settings update function. There are no privilege requirements, and the vulnerability is exploitable over standard web protocols (HTTP/HTTPS) without needing legitimate session cookies or CSRF tokens."
}