CVE-2026-6708

Name of the Vulnerable Software and Affected Versions HEL Online Classroom: AI-powered Online Classrooms versions prior to 1.0.4

Description Missing authorization in a REST API endpoint allows unauthenticated attackers to delete any classroom record. This occurs because the endpoint is registered with a permission callback of return true, which bypasses all WordPress authentication and authorization checks. An attacker can trigger this by supplying the classroom ID in the request, leading to permanent data loss.

Recommendations Update the plugin to a version later than 1.0.3.