Description

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-29T06:17:39.037Z",
  "pubdate": "2026-08-29T06:17:39.037Z",
  "executiveSummary": "The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin (versions 1.0.3 and below) contains a critical security flaw involving improper authorization validation within its REST API endpoints.\nThis vulnerability allows unauthenticated remote attackers to bypass access control mechanisms, specifically targeting per-class access codes designed to restrict meeting entry.\nBy interacting directly with the exposed API routes, an attacker can retrieve signed meeting join links for any classroom instance, including those secured by private codes.\nSuccessful exploitation results in unauthorized access to sensitive virtual classrooms and, critically, grants the attacker moderator-level privileges within the meeting session.\nThe risk is considered severe as it permits unauthorized parties to disrupt sessions, eavesdrop on private academic environments, or manipulate meeting configurations without requiring legitimate credentials or institutional access tokens.\nNo specific user interaction is required for this exploitation, and the attack can be executed entirely via public network access.",
  "technicalDetails": "The root cause of this vulnerability lies in a lack of server-side authorization checks within the plugin's REST API controller logic. The plugin fails to verify the session or authentication status of the requester when accessing meeting-related metadata and join-link generation endpoints.\nFurthermore, the implementation fails to enforce the validation of per-class access codes at the controller level before generating session tokens. Even when a classroom is configured as private, the API fails to confirm the user possesses the required access code before processing the join link request.\nThe exploitation flow is as follows: An unauthenticated attacker identifies the REST API endpoints associated with the HEL Online Classroom plugin. By sending a specially crafted HTTP request to these endpoints, the attacker requests the connection parameters for a targeted meeting ID. Because the application lacks permission scoping, the REST API processes this request as a valid invocation of the join-link generation function.\nThe server, treating the attacker as an authorized entity, generates a signed join link. Critically, the implementation flaw extends to the privilege assignment logic, where the resulting join link is signed with elevated permissions. By visiting this URL, the attacker is injected into the virtual classroom with moderator privileges, bypassing the intended authentication layer entirely.\nThis vulnerability is present in versions 1.0.3 and below. The exposure is total, as the REST API is accessible to any public internet user. Post-exploitation, the attacker gains full control over the meeting session, allowing them to manage participants, mute or remove users, and record the session, effectively compromising the integrity and confidentiality of the online classroom environment."
}