CVE-2026-9619

Name of the Vulnerable Software and Affected Versions Reviews and Rating – Docplanner plugin for WordPress versions prior to 1.1.5

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with subscriber-level access or higher can trigger outbound scraping of external websites and write the resulting data into the wp dp reviews database table. Additionally, this flaw allows attackers to send feature-request emails using the site administrator's email address.

Recommendations Update the plugin to a version newer than 1.1.4.