CVE-2026-77007: HEL Online Classroom Information Disclosure

CVE-2026-77007 Overview

CVE-2026-77007 is a missing authorization vulnerability in the HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through version 1.0.3. The plugin fails to perform authorization checks on one of its REST API routes. Unauthenticated attackers can retrieve stored plugin settings through this exposed endpoint. The disclosed data includes the shared secret used to sign API requests to the connected BigBlueButton server. This information disclosure [CWE-200] enables attackers to forge signed requests to the linked BigBlueButton conferencing infrastructure.

Critical Impact
Unauthenticated remote attackers can extract the BigBlueButton shared secret and impersonate the WordPress site when signing API calls to the conferencing server.

Affected Products

HEL Online Classroom: AI-powered Online Classrooms WordPress plugin
All versions through 1.0.3
WordPress sites integrating the plugin with a BigBlueButton server

Discovery Timeline

2026-08-29 - CVE-2026-77007 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-77007

Vulnerability Analysis

The HEL Online Classroom plugin exposes a REST API route that returns the plugin's stored settings. The route lacks a permission_callback that enforces authentication or capability checks. Any unauthenticated HTTP client can query the endpoint and receive the full settings payload in response.

The response contains the BigBlueButton shared secret. BigBlueButton uses this secret as a symmetric signing key: the WordPress plugin appends an SHA-1 checksum of each API call plus the secret to authenticate itself to the conferencing server. Disclosure of the secret breaks that trust boundary.

An attacker with the secret can sign arbitrary API calls to the BigBlueButton server as if they originated from the legitimate WordPress instance. This enables meeting creation, meeting termination, retrieval of recordings, and enumeration of active sessions on the connected conferencing backend.

Root Cause

The root cause is a missing authorization check on a REST API route registered by the plugin. WordPress register_rest_route() calls require a permission_callback that validates the request. When this callback returns true or is absent, the route becomes publicly accessible. The affected endpoint returns configuration data that should be restricted to administrators.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker sends an unauthenticated HTTP GET request to the vulnerable REST route under /wp-json/. No user interaction, credentials, or elevated privileges are needed. The server returns the plugin settings, including the BigBlueButton shared secret, in the response body.

See the WPScan Vulnerability Report for endpoint-specific technical details.

Detection Methods for CVE-2026-77007

Indicators of Compromise

Unauthenticated HTTP requests to plugin-specific REST routes under /wp-json/ returning non-empty settings payloads.
BigBlueButton server logs showing valid signed API calls from source IP addresses that do not match the WordPress host.
Unexpected meeting creation, recording access, or session enumeration events on the connected BigBlueButton server.

Detection Strategies

Inspect web server access logs for GET requests to REST routes registered by the HEL Online Classroom plugin from unauthenticated sessions.
Correlate BigBlueButton API request source IPs against the WordPress site's expected egress addresses.
Alert on responses from /wp-json/ endpoints that contain strings matching BigBlueButton secret patterns.

Monitoring Recommendations

Enable REST API request logging on WordPress and forward events to a central log platform for correlation.
Monitor BigBlueButton create, getRecordings, and getMeetings API calls for volume anomalies.
Track outbound signed requests to the BigBlueButton server for unexpected user agents or geographies.

How to Mitigate CVE-2026-77007

Immediate Actions Required

Deactivate the HEL Online Classroom plugin until a patched version is confirmed installed.
Rotate the BigBlueButton shared secret on the conferencing server and update all integrations that reference it.
Restrict access to /wp-json/ REST routes at the web server or WAF layer for unauthenticated clients where feasible.
Review BigBlueButton server logs for signed API calls that predate the secret rotation.

Patch Information

At the time of publication, the NVD entry lists all versions through 1.0.3 as affected and does not identify a fixed release. Monitor the WPScan Vulnerability Report and the plugin vendor's changelog for a patched version. Apply updates as soon as a fixed release is available.

Workarounds

Block unauthenticated access to the vulnerable REST route using a WAF rule or web server directive until a patch is applied.
Isolate the BigBlueButton server behind IP allowlists that only accept API calls from the legitimate WordPress host.
Rotate the BigBlueButton shared secret regularly while the plugin remains in use and after any suspected exposure.

bash

# Example nginx directive to block unauthenticated access to the plugin's REST namespace
location ~* /wp-json/hel-online-classroom/ {
    deny all;
    return 403;
}