What is the CVSS score of CVE-2026-9619?

CVE-2026-9619 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Docplanner Reviews Plugin CVE-2026-9619

EUVD-2026-38666 MEDIUM

Missing Authorization (CWE-862)

2026-06-24 Wordfence

GHSA-4mjw-w6x3-qgcr

WordPress Authentication Bypass Wordpress Plugin Reviews And Rating Docplanner

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible WordPress AJAX endpoint, low complexity, subscriber authentication required (PR:L), integrity-only impact via DB write and email spoofing.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:57 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 4.3

DescriptionCVE.org

The Reviews and Rating - Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger outbound scraping of external websites and write scraped review data into the wp_dp_reviews database table, as well as send feature-request emails from the site administrator's email address.

AnalysisAI

Authorization bypass in the Reviews and Rating - Docplanner WordPress plugin (versions ≤ 1.1.4) allows any authenticated subscriber-level user to invoke privileged plugin actions without proper capability checks. Exploitation enables two distinct abuse paths: triggering server-side outbound scraping of attacker-controlled or arbitrary external URLs with results written to the wp_dp_reviews database table, and dispatching feature-request emails impersonating the site administrator's address. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Technical ContextAI

The affected product is identified by CPE cpe:2.3:a:berfect:reviews_and_rating_-_docplanner:*:*:*:*:*:*:*:* - a WordPress plugin developed by 'berfect' that integrates WordPress sites with the Docplanner healthcare appointment marketplace to display scraped reviews. The root cause is CWE-862 (Missing Authorization): WordPress actions or AJAX handlers registered by the plugin (visible at class-reviews-and-rating-docplanner.php lines L81, L301, L369, L401, L410) fail to verify that the calling user holds an appropriate capability before executing privileged operations. WordPress's capability system provides functions like current_user_can() to gate such actions, and their absence or incorrect application allows any logged-in subscriber to bypass intended access controls and invoke functionality reserved for editors or administrators.

RemediationAI

No explicitly patched release version is confirmed in the available input data - the highest documented version is 1.1.4, which remains vulnerable. Site administrators should check the WordPress plugin repository for a version newer than 1.1.4 and upgrade immediately if available. Until a fix is confirmed, the most effective compensating control is to deactivate and remove the plugin entirely, which eliminates the exposed AJAX or action handlers. If the plugin is operationally required, restrict WordPress user registration to prevent untrusted subscribers from obtaining accounts, and audit existing subscriber-level accounts for necessity. Web application firewall rules that block unauthenticated and low-privilege AJAX requests to wp-admin/admin-ajax.php targeting this plugin's action names may provide partial mitigation but require identifying the specific action slugs from the source code at lines L81, L301, L369, L401, and L410. Note that deactivating the plugin will disable review display functionality on the site.