PT-2026-47672 · WordPress · Helpfulcrowd Product Reviews
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Helpfulcrowd Product Reviews versions prior to 1.3.0
Description
The Helpfulcrowd Product Reviews plugin for WordPress allows unauthenticated authorization bypass due to PHP Type Juggling. This occurs because the
helpfulcrowd validate token() function uses a loose comparison operator (!=) instead of a strict comparison (!==) when validating the token parameter. Since the REST route "/wp-json/helpfulcrowd/v1/update-settings" is registered with a permission callback of return true, it is accessible to unauthenticated users. By submitting a JSON boolean true as the token value, the loose comparison evaluates as equal to the non-empty base64-encoded secret string, bypassing the security check. Consequently, attackers can invoke helpfulcrowd settings endpoint() to write arbitrary key-value pairs into the helpfulcrowd options WordPress database option via update option() without sanitization or allowlist filtering, leading to full modification of the plugin configuration.Recommendations
Update the plugin to a version later than 1.2.9.
As a temporary workaround, restrict access to the "/wp-json/helpfulcrowd/v1/update-settings" endpoint to minimize the risk of exploitation.
Fix
Type Confusion
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Helpfulcrowd Product Reviews