WordPress Plugin Vulnerabilities

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

Description

The plugin does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

Proof of Concept

Affects Plugins

Plugin icon
tripzzy
Fixed in 1.5.1

References

CVE
CVE-2026-87839

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter website
https://telefonica.com
Verified
Yes
WPVDB ID
e5145602-cb5e-4ef9-a51b-8f161200d014

Timeline

Publicly Published
2026-09-18 (about 2 days ago)
Added
2026-09-18 (about 1 day ago)
Last Updated
2026-09-18 (about 1 day ago)

Other

Published
Title
Published
2021-08-23
Title
OMGF < 4.5.4 - Subscriber+ Arbitrary File/Folder Deletion
Published
2022-05-18
Title
Jupiter < 6.10.2 & JupiterX < 2.0.7 - Subscriber+ Path Traversal and Local File Inclusion
Published
2025-05-29
Title
Featured Image Plus < 1.6.6 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update
Published
2024-02-12
Title
Sunshine Photo Cart: Free Client Galleries for Photographers < 3.1 - Unauthenticated Sensitive Information Exposure via Invoice
Published
2024-06-05
Title
BuddyPress Members Only < 3.4.9 - Improper Access Control to Sensitive Information Exposure via REST API