CVE-2026-87839 — Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to u…
Published: 2026-09-20 · CVSS: 7.5 · CVSS 3.1
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7