CVE-2026-87839

HighCVSS 7.5

Published: 20/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 20/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The Tripzzy WordPress plugin before 1.5.1 does not have authorization checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users. This allows them to permanently delete arbitrary comments on the site.

Risk Assessment

An unauthenticated attacker can permanently delete arbitrary comments, leading to data loss and possible content manipulation. This poses a threat to data integrity and site reputation.

Recommendation

Update the Tripzzy plugin to version 1.5.1 or later. Until updated, consider disabling the plugin or restricting access to its AJAX endpoints.

Other vulnerabilities in Tripzzy WordPress plugin

CVE-2026-87840Medium
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the plugin issues to any anonymous visitor on request. This allows unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.

Original NVD description (English source)

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS