CVE-2026-9619 Overview
CVE-2026-9619 is an authorization bypass vulnerability in the Reviews and Rating – Docplanner plugin for WordPress, affecting all versions up to and including 1.1.4. The plugin fails to verify whether a user is authorized to invoke several privileged actions. Authenticated attackers with subscriber-level access or higher can trigger outbound scraping of external websites, write scraped review data into the wp_dp_reviews database table, and send feature-request emails that appear to originate from the site administrator's email address. The weakness is tracked under [CWE-862] (Missing Authorization).
Critical Impact
Low-privileged authenticated users can abuse the site to scrape third-party content, write attacker-controlled rows into the reviews table, and impersonate the administrator email address in outbound feature-request messages.
Affected Products
- Reviews and Rating – Docplanner plugin for WordPress, all versions through 1.1.4
- WordPress sites that permit subscriber-level (or higher) account registration with the plugin installed
- Multi-author or membership WordPress deployments running the affected plugin
Discovery Timeline
- 2026-06-24 - CVE-2026-9619 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-9619
Vulnerability Analysis
The plugin exposes several AJAX or admin-post handlers that perform privileged work without checking the caller's capability. According to the Wordfence Vulnerability Analysis, the affected handlers in classes/class-reviews-and-rating-docplanner.php (lines 81, 301, 369, 401, and 410) rely on standard WordPress nonce processing or hook registration, but omit a current_user_can() capability check.
As a result, any authenticated user, including the default subscriber role, can invoke functionality that should be reserved for administrators. The vulnerability produces low-integrity impact: data is written to the database and emails are dispatched, but confidentiality and availability are not directly affected.
Root Cause
The root cause is missing authorization on action handlers. WordPress separates authentication (a valid logged-in user) from authorization (the user has the required capability). The plugin treats authentication as sufficient and never confirms the role of the caller before performing privileged tasks.
Attack Vector
An attacker first obtains any authenticated session, for example through self-registration on sites where it is enabled. The attacker then issues requests to the vulnerable plugin endpoints to:
- Trigger server-side HTTP requests that scrape arbitrary external URLs from the WordPress host.
- Insert attacker-controlled review records into the wp_dp_reviews table.
- Cause the site to send feature-request emails using the administrator's From address, enabling spoofing and reputation abuse.
The vulnerability is exploitable over the network and requires no user interaction beyond the attacker's own authenticated session. See the WordPress Plugin Code Review for the vulnerable handler registrations.
Detection Methods for CVE-2026-9619
Indicators of Compromise
- Unexpected rows in the wp_dp_reviews table that do not correspond to legitimate reviewer activity.
- Outbound HTTP requests from the WordPress host to third-party domains correlated with subscriber-level session activity.
- Outbound SMTP messages with feature request subjects originating from the administrator email address but not initiated by an administrator.
Detection Strategies
- Review web server access logs for authenticated admin-ajax.php or admin-post.php calls invoking Docplanner reviews actions from non-administrator user IDs.
- Audit the wp_dp_reviews table for spikes in row inserts and for entries with anomalous source URLs or content.
- Inspect mail logs for feature-request style messages whose envelope sender is the site administrator but whose origin user is a subscriber.
Monitoring Recommendations
- Enable WordPress action logging to capture user ID, IP, and capability context for each plugin AJAX call.
- Alert on any newly registered subscriber accounts followed shortly by plugin AJAX activity.
- Monitor egress traffic from the WordPress host for high-volume outbound scraping patterns to external sites.
How to Mitigate CVE-2026-9619
Immediate Actions Required
- Update the Reviews and Rating – Docplanner plugin to a version newer than 1.1.4 as soon as a patched release becomes available.
- Disable the plugin on sites that permit open subscriber registration until a fix is applied.
- Audit existing accounts and remove untrusted subscriber-level users created during the exposure window.
Patch Information
At the time of publication, no fixed version above 1.1.4 is referenced in the NVD entry. Site operators should track the plugin's repository on WordPress.org and the Wordfence Vulnerability Analysis advisory for the patched release.
Workarounds
- Disable open user registration in WordPress settings to remove the prerequisite authenticated session.
- Restrict access to wp-admin/admin-ajax.php and wp-admin/admin-post.php from untrusted networks where feasible.
- Apply a web application firewall rule that blocks subscriber-level calls to the affected plugin actions identified in the WordPress Plugin Code Review.
# Configuration example: disable open WordPress registration via WP-CLI
wp option update users_can_register 0
# Temporarily deactivate the vulnerable plugin
wp plugin deactivate reviews-and-rating-docplanner
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
