What is the CVSS score of CVE-2026-8499?

CVE-2026-8499 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Helpfulcrowd Product Reviews CVE-2026-8499

EUVD-2026-35302 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-09 Wordfence

GHSA-q2xw-j7qq-rpp9

PHP Memory Corruption WordPress RCE

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:18 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 5.3

DescriptionCVE.org

The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the helpfulcrowd_validate_token() function using a loose comparison operator (!=) instead of a strict comparison (!==) when validating the token parameter, while the corresponding REST route /wp-json/helpfulcrowd/v1/update-settings is registered with a permission_callback of __return_true, making it reachable by unauthenticated users; submitting a JSON boolean true as the token value causes PHP's loose comparison to evaluate as equal to the non-empty base64-encoded secret string, bypassing the check entirely. This makes it possible for unauthenticated attackers to invoke helpfulcrowd_settings_endpoint() and write arbitrary attacker-controlled key-value pairs directly into the helpfulcrowd_options WordPress database option via update_option() without any sanitization or allowlist filtering, enabling full unauthenticated modification of the plugin's stored configuration.

AnalysisAI

Unauthenticated settings manipulation in Helpfulcrowd Product Reviews plugin for WordPress (versions up to and including 1.2.9) allows any remote attacker to overwrite arbitrary plugin configuration values in the WordPress database. The vulnerability stems from a PHP type juggling flaw in the token validation function combined with an openly accessible REST endpoint registered with __return_true as its permission callback. By submitting a JSON boolean true as the token value, an attacker bypasses the loose-comparison check (!=) in helpfulcrowd_validate_token() and gains full write access to the helpfulcrowd_options database option with no sanitization or allowlist enforcement. No public exploit or CISA KEV listing is identified at time of analysis.

Technical ContextAI

The affected code resides in HelpfulcrowdCustomEndpoints.php within the Helpfulcrowd Product Reviews plugin for WordPress (CPE: cpe:2.3:a:helpfulcrowd:helpfulcrowd_product_reviews:*:*:*:*:*:*:*:*). The REST route /wp-json/helpfulcrowd/v1/update-settings is registered with WordPress's register_rest_route() using __return_true as the permission_callback, which unconditionally grants access to all requesters including unauthenticated users. The vulnerability is classified as CWE-843 (Access of Resource Using Incompatible Type, 'Type Confusion'). PHP's loose comparison operator (!=) does not enforce type equality: when the expected token is a non-empty base64-encoded string and the attacker supplies a JSON boolean true, PHP coerces both to truthy values and the comparison evaluates to false (i.e., 'not not-equal'), bypassing the guard. The downstream sink is update_option('helpfulcrowd_options', ...) called from helpfulcrowd_settings_endpoint() in core.php with no input sanitization or allowlist filtering on the key-value pairs supplied by the attacker.

RemediationAI

No vendor-released patch version is identified in the available data at time of analysis; users should consult the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/26f34aa0-8584-4156-b084-d34a0ab0a997 for an updated release. Until a patched version is available, the most effective compensating control is to deactivate and remove the Helpfulcrowd Product Reviews plugin entirely from WordPress installations, eliminating the attack surface with no meaningful trade-off for sites where the plugin is non-essential. If the plugin must remain active, a WAF rule blocking POST requests to the REST endpoint /wp-json/helpfulcrowd/v1/update-settings from unauthenticated sessions will mitigate exploitation, though this requires a WAF capable of inspecting WordPress REST API paths and may block legitimate plugin synchronization traffic. Restricting REST API access to authenticated users site-wide via the rest_authentication_errors filter is a broader WordPress hardening measure but carries the trade-off of breaking other plugins or themes that depend on public REST endpoints. Site administrators should also audit the current contents of the helpfulcrowd_options database option for unexpected or attacker-injected values as part of incident response.