CVE-2026-8499
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Helpfulcrowd Product Reviews plugin for WordPress up to version 1.2.9 contains an Authorization Bypass via PHP Type Juggling. The helpfulcrowd_validate_token() function uses a loose comparison operator (!=) instead of strict (!==) when validating the token parameter, and the REST route /wp-json/helpfulcrowd/v1/update-settings is registered with permission_callback set to __return_true, making it reachable by unauthenticated users. Submitting a JSON boolean true as the token value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This allows unauthenticated attackers to invoke helpfulcrowd_settings_endpoint() and write arbitrary attacker-controlled key-value pairs directly into the helpfulcrowd_options WordPress database option via update_option() without sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.
Risk Assessment
The risk is that an unauthenticated attacker can fully compromise the plugin's configuration, potentially leading to further attacks on the site.
Recommendation
It is recommended to immediately update the plugin to version 1.3.0 or later, which includes the fix.
Related vulnerabilities
- CVE-2026-119506Critical
The Frontend Admin by DynamiApps plugin (acf-frontend-form-element) through version 3.30.1 contains an incorrect privilege assignment vulnerability. The flaw allows an attacker to escalate privileges within the WordPress site.
- CVE-2026-6715Critical
IBM Concert 1.0 through 3.0.1.1 allows an attacker to supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the affected service.
- CVE-2026-17466Critical
IBM Optim versions 1.0.0, 1.1.0, and 1.2.0 are vulnerable to path traversal, allowing a remote authenticated attacker to obtain sensitive information.
- CVE-2026-15266Critical
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
- CVE-2026-114464Critical
IBM Process Mining 2.0.0 through 2.2.1 has improper access control, which could allow a remote attacker to obtain sensitive information.
- CVE-2026-107331Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 has an absolute-path traversal vulnerability that could allow a remote authenticated attacker to obtain sensitive information.
- CVE-2026-109900Critical
The Melapress Role Editor plugin for WordPress (through version 1.3.0) contains an incorrect privilege assignment vulnerability that allows privilege escalation. A low-privileged user can gain a higher level of access within the system.
- CVE-2026-101117Critical
IBM WebSphere Extreme Scale versions 8.6.1.0 through 8.6.2.2 have an improper Content Security Policy configuration that could allow a remote attacker to bypass security restrictions. The flaw concerns browser-side protection mechanisms.
- CVE-2026-124494Critical
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links.
- CVE-2026-124493Critical
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mode initialize, enabling session cookie theft.
Original NVD description (English source)
The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the `helpfulcrowd_validate_token()` function using a loose comparison operator (`!=`) instead of a strict comparison (`!==`) when validating the `token` parameter, while the corresponding REST route `/wp-json/helpfulcrowd/v1/update-settings` is registered with a `permission_callback` of `__return_true`, making it reachable by unauthenticated users; submitting a JSON boolean `true` as the `token` value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This makes it possible for unauthenticated attackers to invoke `helpfulcrowd_settings_endpoint()` and write arbitrary attacker-controlled key-value pairs directly into the `helpfulcrowd_options` WordPress database option via `update_option()` without any sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS