Authorization Bypass in Docplanner Plugin for WordPress

CVE-2026-9619

What is CVE-2026-9619?

The Reviews and Rating – Docplanner plugin for WordPress contains an authorization bypass flaw in all versions up to and including 1.1.4. This vulnerability arises from inadequate verification of user permissions, allowing authenticated attackers, including those with subscriber-level access, to execute unauthorized actions. This exploitation can lead to the scraping of external websites and subsequent unauthorized writing of review data into the wp_dp_reviews database table. Additionally, attackers can misuse the site's administrator email for sending feature-request emails, potentially compromising the integrity and confidentiality of site communications.

References