Helpfulcrowd Product Reviews Plugin up to 1.2.9 on WordPress Setting update-settings helpfulcrowd_validate_token type confusion

Summaryinfo

A vulnerability marked as critical has been reported in Helpfulcrowd Product Reviews Plugin up to 1.2.9 on WordPress. This affects the function helpfulcrowd_validate_token of the file /wp-json/helpfulcrowd/v1/update-settings of the component Setting Handler. This manipulation of the argument token causes type confusion. This vulnerability is registered as CVE-2026-8499. Remote exploitation of the attack is possible. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Helpfulcrowd Product Reviews Plugin up to 1.2.9 on WordPress. Affected by this vulnerability is the function helpfulcrowd_validate_token of the file /wp-json/helpfulcrowd/v1/update-settings of the component Setting Handler. The manipulation of the argument token with an unknown input leads to a type confusion vulnerability. The CWE definition for the vulnerability is CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the `helpfulcrowd_validate_token()` function using a loose comparison operator (`!=`) instead of a strict comparison (`!==`) when validating the `token` parameter, while the corresponding REST route `/wp-json/helpfulcrowd/v1/update-settings` is registered with a `permission_callback` of `__return_true`, making it reachable by unauthenticated users; submitting a JSON boolean `true` as the `token` value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This makes it possible for unauthenticated attackers to invoke `helpfulcrowd_settings_endpoint()` and write arbitrary attacker-controlled key-value pairs directly into the `helpfulcrowd_options` WordPress database option via `update_option()` without any sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.

The weakness was published by Abhirup Konwar. It is possible to read the advisory at wordfence.com. This vulnerability is known as CVE-2026-8499 since 05/13/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.2.9 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• Helpfulcrowd

Name

• Product Reviews Plugin

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion