Authorization Bypass in Helpfulcrowd Product Reviews Plugin for WordPress

CVE-2026-8499

What is CVE-2026-8499?

The Helpfulcrowd Product Reviews plugin for WordPress is susceptible to an Authorization Bypass due to PHP Type Juggling. This vulnerability exists in versions up to and including 1.2.9, where the helpfulcrowd_validate_token() function fails to utilize strict comparison for the token parameter. An unauthenticated user can exploit this weakness by submitting a JSON boolean true as the token, which PHP interprets as equivalent to the valid base64-encoded secret, allowing them to bypass authorization checks entirely. This flaw exposes critical endpoints, enabling attackers to modify the plugin's stored configuration indiscriminately and without any validation, leading to potential unauthorized control over the WordPress site.

References