CVE-2026-8499
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Helpfulcrowd Product Reviews plugin for WordPress up to version 1.2.9 contains an Authorization Bypass via PHP Type Juggling. The helpfulcrowd_validate_token() function uses a loose comparison operator (!=) instead of strict (!==) when validating the token parameter, and the REST route /wp-json/helpfulcrowd/v1/update-settings is registered with permission_callback set to __return_true, making it reachable by unauthenticated users. Submitting a JSON boolean true as the token value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This allows unauthenticated attackers to invoke helpfulcrowd_settings_endpoint() and write arbitrary attacker-controlled key-value pairs directly into the helpfulcrowd_options WordPress database option via update_option() without sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.
Risk Assessment
The risk is that an unauthenticated attacker can fully compromise the plugin's configuration, potentially leading to further attacks on the site.
Recommendation
It is recommended to immediately update the plugin to version 1.3.0 or later, which includes the fix.
Related vulnerabilities
- CVE-2026-82110Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability due to improper validation of pathnames. A remote authenticated attacker can exploit this to execute arbitrary code.
- CVE-2026-82103Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to an unauthorized actor. A remote authenticated attacker can exploit this to obtain confidential data.
- CVE-2026-82101Critical
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability that can lead to denial of service. A remote authenticated attacker can exploit this to disrupt service availability.
- CVE-2026-90920Critical
IBM Maximo AI Service 9.1.0 and 9.2.0 contains a vulnerability related to improper control of code generation. A remote attacker can exploit this to execute arbitrary code.
- CVE-2026-44828Critical
Qexo versions 4.0.0 through 4.2.0 expose /api/init_step/ without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token can reset the INIT setting and re-enter the setup flow, potentially exposing stored PROVIDER configuration including credentials.
- CVE-2026-109566Critical
Rapyd Admin versions 9.0.0 before 9.20.0 contain hard-coded credentials that allow remote unauthenticated attackers to gain super-admin access through an admin@laravel account with password admin. The account is seeded by the installer and silently re-created on every rpd:make run, bypassing authorization and tenant scoping.
- CVE-2026-108929Critical
Netcore NR268 version 1.7.121109 contains an argument injection vulnerability in the execvp function of the file /router/DDNSset.cgi in the DDNS component. Manipulating the Hostname argument can lead to argument injection, and the attack can be launched remotely.
- CVE-2025-71429Critical
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user.
- CVE-2026-96012Critical
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code and gain elevated privileges.
- CVE-2026-109575Critical
HAProxy Data Plane API versions 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases) have process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS CA is configured and a numeric TLS port is specified, the application globally disables Basic authentication on its shared internal request handler, allowing unauthenticated attackers to reach affected HTTP or UNIX endpoints and completely bypass credentials to gain full API administrative access.
Original NVD description (English source)
The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the `helpfulcrowd_validate_token()` function using a loose comparison operator (`!=`) instead of a strict comparison (`!==`) when validating the `token` parameter, while the corresponding REST route `/wp-json/helpfulcrowd/v1/update-settings` is registered with a `permission_callback` of `__return_true`, making it reachable by unauthenticated users; submitting a JSON boolean `true` as the `token` value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This makes it possible for unauthenticated attackers to invoke `helpfulcrowd_settings_endpoint()` and write arbitrary attacker-controlled key-value pairs directly into the `helpfulcrowd_options` WordPress database option via `update_option()` without any sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS