CVE-2026-9619: WordPress Docplanner Reviews Plugin Authorization Bypass

Technical summary

CVE-2026-9619 is an authorization bypass vulnerability (CWE-862) in the Reviews and Rating – Docplanner WordPress plugin affecting versions up to 1.1.4. The vulnerability stems from insufficient authorization checks on plugin functionality, permitting authenticated users to invoke privileged operations without proper capability verification. Affected operations include triggering outbound HTTP requests to external domains for web scraping, writing unsanitized scraped content into the wp_dp_reviews database table, and initiating SMTP transactions from the site's configured administrative email address. The attack surface is limited to authenticated users (subscriber role and above), but the authorization gap allows privilege escalation within WordPress.

Business impact

Organizations running this plugin face data integrity risks and potential reputational harm. Unauthorized scraping and database writes could populate false or malicious reviews, degrading customer trust. Abuse of the administrator email address for outbound messages (feature-request emails) could be used for phishing campaigns, spam, or business email compromise scenarios that damage sender reputation and trigger mail delivery issues. The vulnerability also creates a vector for internal threats—disgruntled employees or compromised low-privilege accounts become conduits for content manipulation and impersonation attacks.

Affected systems

WordPress installations with the Reviews and Rating – Docplanner plugin installed and activated in versions 1.1.4 and below are vulnerable. The attack requires a valid WordPress user account with at least subscriber-level permissions; there is no requirement for administrator or editor roles. Multisite WordPress installations are in scope if the plugin is network-activated or individually enabled on any site within the network.

Exploitability

Exploitation is straightforward for any authenticated user holding subscriber-level access or above. No user interaction, CAPTCHA bypasses, or social engineering is required—the attacker simply makes direct API or form requests to plugin endpoints lacking proper authorization guards. The attack surface is broad within any organization where external contractors, guest contributors, or third-party integrations have subscriber accounts. This is rated MEDIUM severity (CVSS 4.3) because integrity impact is present but confidentiality and availability are not directly compromised, and an account is required to start the attack.

Remediation

Update the Reviews and Rating – Docplanner plugin to a patched version that implements proper authorization checks (verify against the vendor advisory for the specific version). Until a patch is available, consider disabling or deactivating the plugin if it is not actively used. Organizations unable to patch immediately should restrict subscriber-level account creation to trusted users only and monitor database tables (wp_dp_reviews) for unauthorized modifications.

Patch guidance

Consult the official Docplanner plugin repository or vendor advisory for the first patched version that resolves this authorization bypass. Apply updates through the WordPress admin dashboard (Plugins > Installed Plugins) once a fix is released. Test the update in a staging environment first to confirm no functionality regression, particularly any custom review workflows or integrations that depend on the plugin.

Detection guidance

Monitor WordPress user authentication logs for subscriber-level account creation or unusual login patterns. Track database activity on the wp_dp_reviews table for inserts or updates that do not correlate with expected review submissions. Monitor outbound HTTP traffic from the WordPress server for unexpected domain requests initiated by the plugin. Set up alerts for emails sent from the site's administrative email address, and cross-reference sender identity in mail logs to detect impersonation. Review WordPress activity logs (if logging is enabled) for plugin function calls by low-privilege users.

Why prioritize this

Although rated MEDIUM severity and not yet on the KEV catalog, this vulnerability should be prioritized for patching because (1) exploitation is trivial for any authenticated user, (2) the attack is internal-facing and may go undetected, (3) email impersonation and data manipulation carry business and legal risk, and (4) the plugin may be installed on customer-facing sites where false reviews directly harm brand reputation. Organizations with high-traffic review-dependent sites or strict data integrity requirements should patch as soon as a fix is available.

Risk score, explained

The CVSS 4.3 MEDIUM score reflects limited scope (authenticated user required, no network amplification), low confidentiality impact, but non-negligible integrity impact (database writes, email spoofing). The score does not fully capture the reputational and operational risk of review tampering or email impersonation in a business context; organizations should consider risk elevation if reviews drive customer acquisition or if email spoofing poses a phishing or compliance risk.

Frequently asked questions