high7.5
CVE-2026-87839
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX acti…
Impact
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
Affected products
| Product | Affected versions |
|---|---|
| Tripzzy WordPress Plugin | before 1.5.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.