CVE-2026-9619 is an authorization bypass vulnerability in the Reviews and Rating – Docplanner WordPress plugin affecting all versions up to and including 1.1.4. The plugin fails to properly verify user authorization before allowing certain actions. This allows authenticated users with subscriber-level privileges or higher to initiate outbound scraping of external websites and write the scraped review data into the wp_dp_reviews database table. Furthermore, the vulnerability permits sending feature-request emails from the site administrator's email address, potentially enabling abuse of site functionality. No official patch or remediation level has been provided as of the publication date.

The vulnerability allows authenticated users with low-level privileges to perform unauthorized actions that can affect data integrity by injecting external scraped content into the plugin's database. It also enables sending emails from the administrator's address, which could be used for phishing or social engineering attacks. There is no direct impact on confidentiality or availability reported. The overall impact is limited to integrity and potential abuse of site functionality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for unusual outbound requests or unexpected database changes related to the wp_dp_reviews table. Avoid granting unnecessary privileges to low-level users to reduce exploitation risk.