Hi,
Thanks for the extra details, that was enough to reproduce on our side. The 500 was a regression from the guest reviews via order token fix we shipped earlier: the controller attaches an order_token and an order_id to the vote object so the guest authentication path can read them, but those two fields stayed on the object all the way to the INSERT statement, which tried to write them as columns of the votes table. The votes table has neither column, so MySQL rejected the insert with an "Unknown column" error and the AJAX call came back as HTTP 500. It affected both registered customers and guest customers because the two extra fields were always attached, not only on the guest path.
We just published a new HikaShop 6.4.1 build with the fix. The two fields are now stripped from the vote object right before the save. Please download the latest build from your member area and reinstall it on top of your current install; the review submission flow should work again immediately, both for your registered test user and for guests reviewing through the order email links.