The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to an authorization bypass due to PHP type juggling (CWE‑843). The plugin’s token validation uses a loose inequality comparison operator, and the REST route that updates settings registers a permission callback that always returns true, allowing unauthenticated users to reach the endpoint. By submitting a JSON boolean true as the token, the comparison is bypassed, enabling the attacker to call the settings update function and write arbitrary key–value pairs into the plugin’s options database via update_option() without sanitization or filtering. This results in full, unauthenticated configuration compromise, potentially altering plugin behavior and affecting site content or operations.

WordPress sites that have installed Helpfulcrowd Product Reviews plugin version 1.2.9 or earlier and have not applied a newer release that resolves the token validation and permission callback flaw.

The CVSS score of 5.3 indicates moderate severity, primarily because the flaw allows unauthenticated access and lacks input validation. While an EPSS score is not available, the vulnerability is publicly documented and can be exploited remotely over the network via the exposed REST API. It is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can trivially send a crafted request to /wp-json/helpfulcrowd/v1/update-settings with a JSON true token to modify the plugin’s configuration.