Kimsunghoon

**Name of the Vulnerable Software and Affected Versions** HEL Online Classroom: AI-powered Online Classrooms versions prior to 1.0.4 **Description** The plugin fails to perform authorization checks on a REST API route. This allows unauthenticated users to retrieve stored settings, which include the shared secret used to sign API requests sent to the connected BigBlueButton server. **Recommendations** Update the plugin to a version newer than 1.0.3.

**Name of the Vulnerable Software and Affected Versions** HEL Online Classroom: AI-powered Online Classrooms versions prior to 1.0.4 **Description** The plugin lacks authorization and authentication checks when saving settings. This allows unauthenticated users to overwrite configuration settings and redirect all online classrooms, including the shared secret used to sign sessions, to an external infrastructure controlled by the attacker. **Recommendations** Update the plugin to a version newer than 1.0.3.

**Name of the Vulnerable Software and Affected Versions** HEL Online Classroom: AI-powered Online Classrooms versions prior to 1.0.4 **Description** The plugin fails to perform authorization checks on its REST API routes and does not consistently enforce per-class access codes. This allows unauthenticated users to obtain a signed meeting join link for any classroom, regardless of whether an access code is required, and grant themselves moderator privileges upon joining. **Recommendations** Update the plugin to a version newer than 1.0.3.

**Name of the Vulnerable Software and Affected Versions** User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin versions prior to 4.3.8 **Description** An issue exists where the software fails to correctly verify ownership before deleting an attachment. This allows unauthenticated attackers to permanently delete author-less attachments, including guest uploads and installed placeholder media. **Recommendations** Update User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin to version 4.3.8 or later.