PT-2026-47672 · Helpfulcrowd · Helpfulcrowd Product Reviews
Abhirup Konwar
·
Published
2026-06-09
·
Updated
2026-06-09
·
CVE-2026-8499
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the
helpfulcrowd validate token() function using a loose comparison operator (!=) instead of a strict comparison (!==) when validating the token parameter, while the corresponding REST route /wp-json/helpfulcrowd/v1/update-settings is registered with a permission callback of return true, making it reachable by unauthenticated users; submitting a JSON boolean true as the token value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This makes it possible for unauthenticated attackers to invoke helpfulcrowd settings endpoint() and write arbitrary attacker-controlled key-value pairs directly into the helpfulcrowd options WordPress database option via update option() without any sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.Fix
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Helpfulcrowd Product Reviews