CVE-2026-87839 PUBLISHED

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

Assigner: WPScan
Reserved: 09.09.2026 Published: 20.09.2026 Updated: 20.09.2026

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

Product Status

Vendor Unknown
Product Tripzzy
Versions Default: unaffected
  • affected from 1.1.8 to 1.5.1 (excl.)

Credits

  • Pablo González Pérez finder
  • Francisco José Ramírez Vicente and Iñigo Sánchez Enciso finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE