CVE-2026-9619: Berfect Reviews And Rating – Docplanner

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger outbound scraping of external websites and write scraped review data into the wp_dp_reviews database table, as well as send feature-request emails from the site administrator's email address.

Affected products

• Berfect Reviews And Rating – Docplanner: up to and including 1.1.4

Published 2026-06-24. Last modified 2026-06-25.