Berfect vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Berfect products: 1 record(s), with severity, exploitation and fixes.

Reviews and Rating – Docplanner 1

Exploited only (KEV) →

CVE-2026-9619 Medium · 4.3 CWE-862 Jun 24, 2026

Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action

The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to trigger outbound scraping of external websites and write scraped review data into the wp_dp_reviews database table, as well as send feature-request emails from the site administrator's email address.