CVE-2026-87840
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the plugin issues to any anonymous visitor on request. This allows unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
Risk Assessment
An unauthenticated attacker can modify arbitrary bookings, including their contents, totals and notes, leading to data integrity violations and potential financial losses. This poses a serious threat to booking-based business operations.
Recommendation
Update the Tripzzy plugin to version 1.5.1 or later. Until updated, consider disabling the plugin or restricting access to its endpoints.
Other vulnerabilities in Tripzzy WordPress plugin
Original NVD description (English source)
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS