CVE-2026-9619 PUBLISHED

Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action

Assigner: Wordfence
Reserved: 26.05.2026 Published: 24.06.2026 Updated: 24.06.2026

The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger outbound scraping of external websites and write scraped review data into the wp_dp_reviews database table, as well as send feature-request emails from the site administrator's email address.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Product Status

Vendor berfect
Product Reviews and Rating – Docplanner
Versions Default: unaffected
  • affected from 0 to 1.1.4 (incl.)

Credits

  • Benedictus Jovan finder

References

Problem Types

  • CWE-862 Missing Authorization CWE