medium5.3
CVE-2026-87840
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are addit…
Impact
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
Affected products
| Product | Affected versions |
|---|---|
| Tripzzy WordPress Plugin | before 1.5.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.