Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

Description

The plugin does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the plugin issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.