Skip to content
Sign in
7.5 High

CVE-2026-87839 The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of…

Description

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

Affected products and versions

Product Affected versions Fixed in
Tripzzy 1.1 1.1.8 → < 1.5.1 1.5.1

Other CVEs of Tripzzy

The 2 CVEs of Tripzzy →
CVE-2026-87840 The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative… 5.3 Medium
Track this CVE