CVE-2026-87839
Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
- State
- Published
- Severity
- 7.5 High
- Published
- Sep 20, 2026
- Updated
- Sep 20, 2026
- Reserved
- Sep 9, 2026
Description
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
TripzzyUnknown |
|
References
- https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.