CVE-2026-77008mediumCWE-284

CVE-2026-77008: fallo de gravedad media en HEL Online Classroom: AI-powered Online…

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear HEL Online Classroom: AI-powered Online Classrooms

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

33Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendcvss 6.5epss 0.4%
The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Productos afectados
Unknown · HEL Online Classroom: AI-powered Online Classrooms
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — HEL Online Classroom: AI-powered Online…

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-77007HIGHHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret DisclosureEPSS 0.4%CVE-2026-77010MEDIUMHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code BypassEPSS 0.3%