Technical impact
The Reviews and Rating – Docplanner plugin for WordPress contains an authorization check flaw that allows an attacker who has logged in with a subscriber role or higher to perform actions that should be restricted. By exploiting the sync_reviews AJAX endpoint, the attacker can cause the plugin to scrape external websites and write the retrieved review data into the wp_dp_reviews database table. The same endpoint also enables the attacker to send feature‑request emails that appear to originate from the site administrator’s address. This vulnerability compromises the integrity of review data and creates a vector for phishing and social‑engineering attacks.
Affected Systems
WordPress sites running any version of the Reviews and Rating – Docplanner plugin up to and including 1.1.4 are affected. Users who possess at least subscriber-level privileges can trigger the flaw; installations without such users remain unaffected.
Risk and Exploitability
The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available, so the exploitation likelihood cannot be quantified, but the availability of an authenticated attacker with subscriber or higher privileges elevates the risk. The vulnerability is not listed in the CISA KEV catalog. Attackers must first authenticate to the WordPress site; once authenticated, they can invoke the exposed sync_reviews endpoint to perform unauthorized actions without further privileges.
