WordPress Tripzzy plugin < 1.5.1 - Unauthenticated Booking Data Tampering vulnerability

Unauthenticated Booking Data Tampering vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Tripzzy Travel Engine System versions 1.5.1...

CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...