CVE-2026-9619
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile — higher than 22% of all known CVEs
Summary
The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action.
Risk Assessment
The risk is that authenticated attackers with subscriber-level access and above can trigger outbound scraping of external websites and write scraped review data into the wp_dp_reviews database table.
Recommendation
It is recommended to update the plugin to the latest version to mitigate the authorization vulnerability and restrict access to plugin features only to authorized users.
Original NVD description (English source)
The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger outbound scraping of external websites and write scraped review data into the wp_dp_reviews database table, as well as send feature-request emails from the site administrator's email address.