Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

HEL Online Classroom plugin: Unauthenticated data deletion

CVE-2026-6708 · published 5 months ago
Summary

The HEL Online Classroom plugin for WordPress allows unauthenticated attackers to delete classroom records. This means that anyone can delete important data without needing a password. To fix this, update the plugin to the latest version or remove it if you're not using it.

Original advisory text
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability c...
The HEL Online Classroom: AI-powered Online Classrooms plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.3. This is due to a missing capability check on a REST API endpoint registered with a permission_callback of '__return_true', which bypasses all WordPress authentication and authorization checks. This makes it possible for unauthenticated attackers to delete any classroom record by supplying its ID in the request, resulting in permanent data loss.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published12 May 2026
Updated31 Oct 2026
First seen12 May 2026
Sources
CVE-2026-6708 · NVD
Track software like this
Free during beta