CVE-2026-8499 is a vulnerability in the Helpfulcrowd Product Reviews plugin for WordPress affecting versions prior to 1.2.10. The issue arises because the function helpfulcrowd_validate_token() uses a loose comparison operator (!=) instead of a strict one (!==) when validating the token parameter. The REST route /wp-json/helpfulcrowd/v1/update-settings is registered with a permission callback that always returns true, allowing unauthenticated access. By submitting a JSON boolean true as the token, PHP's loose comparison treats it as equal to the expected base64-encoded secret string, bypassing the token check. This enables unauthenticated attackers to invoke the settings endpoint and write arbitrary key-value pairs into the helpfulcrowd_options database option without sanitization or filtering, resulting in full unauthenticated modification of the plugin's stored configuration.

An unauthenticated attacker can bypass authorization controls and modify the plugin's configuration settings arbitrarily. This could lead to unauthorized changes in plugin behavior or persistent malicious configuration, potentially affecting site integrity or security. The vulnerability does not directly impact confidentiality or availability but allows integrity compromise of plugin settings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected REST endpoint if possible or disable the Helpfulcrowd Product Reviews plugin. Avoid exposing the vulnerable endpoint to unauthenticated users. Monitor for vendor updates regarding an official fix.