An unauthenticated information disclosure vulnerability in the HEL Online Classroom WordPress plugin exposes sensitive API credentials, potentially allowing unauthorized access to connected BigBlueButton servers.

The vulnerability is an information exposure (CWE-200) resulting from a missing authorization check on a REST API endpoint. This flaw permits any unauthenticated user to retrieve plugin configuration data, specifically the shared secret used for BigBlueButton API authentication.

The exposure of the BigBlueButton shared secret grants an attacker the ability to sign fraudulent API requests, which may lead to unauthorized control over virtual classroom sessions or the interception of sensitive meeting data. Given the CVSS score of 7.5, this high-severity vulnerability presents a significant risk to organizational privacy and the integrity of online learning environments.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate and remove the HEL Online Classroom plugin if it is not mission-critical. If the plugin must remain active, monitor vendor channels for the release of version 1.0.4 or higher.

Proactive Monitoring: Review web server logs for suspicious requests targeting REST API endpoints associated with the plugin, specifically looking for unauthorized access attempts to configuration routes.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the plugin specific REST API paths until a formal patch is applied.

Public Exploit Available: Unknown

The severity of this flaw necessitates immediate attention due to the exposure of cryptographic secrets. Organizations currently utilizing this plugin should treat the configuration as compromised and rotate any BigBlueButton secrets that were stored within the plugin settings as soon as a secure configuration can be restored.