CVE-2026-8499

Name of the Vulnerable Software and Affected Versions Helpfulcrowd Product Reviews versions prior to 1.3.0

Description The Helpfulcrowd Product Reviews plugin for WordPress allows unauthenticated authorization bypass due to PHP Type Juggling. This occurs because the helpfulcrowd validate token() function uses a loose comparison operator (!=) instead of a strict comparison (!==) when validating the token parameter. Since the REST route "/wp-json/helpfulcrowd/v1/update-settings" is registered with a permission callback of return true, it is accessible to unauthenticated users. By submitting a JSON boolean true as the token value, the loose comparison evaluates as equal to the non-empty base64-encoded secret string, bypassing the security check. Consequently, attackers can invoke helpfulcrowd settings endpoint() to write arbitrary key-value pairs into the helpfulcrowd options WordPress database option via update option() without sanitization or allowlist filtering, leading to full modification of the plugin configuration.

Recommendations Update the plugin to a version later than 1.2.9. As a temporary workaround, restrict access to the "/wp-json/helpfulcrowd/v1/update-settings" endpoint to minimize the risk of exploitation.