{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Helpfulcrowd Product Reviews",
          "vendor": "helpfulcrowd",
          "versions": [
            {
              "lessThanOrEqual": "1.2.9",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@wordfence.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the `helpfulcrowd_validate_token()` function using a loose comparison operator (`!=`) instead of a strict comparison (`!==`) when validating the `token` parameter, while the corresponding REST route `/wp-json/helpfulcrowd/v1/update-settings` is registered with a `permission_callback` of `__return_true`, making it reachable by unauthenticated users; submitting a JSON boolean `true` as the `token` value causes PHP\u0027s loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This makes it possible for unauthenticated attackers to invoke `helpfulcrowd_settings_endpoint()` and write arbitrary attacker-controlled key-value pairs directly into the `helpfulcrowd_options` WordPress database option via `update_option()` without any sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin\u0027s stored configuration."
    },
    {
      "lang": "es",
      "value": "El plugin Helpfulcrowd Product Reviews para WordPress es vulnerable a un bypass de autorizaci\u00f3n a trav\u00e9s de PHP Type Juggling en versiones hasta la 1.2.9, inclusive. Esto se debe a que la funci\u00f3n \u0027helpfulcrowd_validate_token()\u0027 utiliza un operador de comparaci\u00f3n flexible (\u0027!=\u0027) en lugar de una comparaci\u00f3n estricta (\u0027!==\u0027) al validar el par\u00e1metro \u0027token\u0027, mientras que la ruta REST correspondiente \u0027/wp-json/helpfulcrowd/v1/update-settings\u0027 est\u00e1 registrada con un \u0027permission_callback\u0027 de \u0027__return_true\u0027, haci\u00e9ndola accesible para usuarios no autenticados; enviar un booleano JSON \u0027true\u0027 como valor del \u0027token\u0027 hace que la comparaci\u00f3n flexible de PHP se eval\u00fae como igual a la cadena secreta no vac\u00eda codificada en base64, omitiendo la verificaci\u00f3n por completo. Esto hace posible que atacantes no autenticados invoquen \u0027helpfulcrowd_settings_endpoint()\u0027 y escriban pares clave-valor arbitrarios controlados por el atacante directamente en la opci\u00f3n de la base de datos de WordPress \u0027helpfulcrowd_options\u0027 a trav\u00e9s de \u0027update_option()\u0027 sin ninguna sanitizaci\u00f3n o filtrado por lista blanca, lo que permite la modificaci\u00f3n completa no autenticada de la configuraci\u00f3n almacenada del plugin."
    }
  ],
  "id": "CVE-2026-8499",
  "lastModified": "2026-07-23T08:10:00.137",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security@wordfence.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-8499",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-09T16:01:47.825981Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-09T05:16:39.373",
  "references": [
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/helpfulcrowd-product-reviews/tags/1.2.9/includes/HelpfulcrowdCustomEndpoints.php#L13"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/helpfulcrowd-product-reviews/tags/1.2.9/includes/HelpfulcrowdCustomEndpoints.php#L71"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://plugins.trac.wordpress.org/browser/helpfulcrowd-product-reviews/tags/1.2.9/includes/core.php#L122"
    },
    {
      "source": "security@wordfence.com",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26f34aa0-8584-4156-b084-d34a0ab0a997?source=cve"
    }
  ],
  "sourceIdentifier": "security@wordfence.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-843"
        }
      ],
      "source": "security@wordfence.com",
      "type": "Secondary"
    }
  ]
}