CVE-2026-114377

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

EUVD-2026-107550

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

CVE-2026-114377 leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

CVE-2026-114377

The leomoon-studios wiki-go software (up to version 1.9.1 ) is vulnerable to a path traversal vulnerability in the Comment Deletion Handler component. Specifically, the DeleteComment function within the internal/comments/comments.go file fails to properly sanitize the documentPath argument. An at...

CVE-2026-114377 leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of the file internal/comments/comments.go of the component Comment Deletion Handler. The manipulation of the argument documentPath leads to path traversal. The...

PT-2026-120808

Name of the Vulnerable Software and Affected Versions leomoon-studios wiki-go versions prior to 1.9.2 Description Remote manipulation of the documentPath argument within the DeleteComment function of the Comment Deletion Handler component leads to path traversal. Path traversal is a condition whe...

CVE-2026-107791

The WP Comment Cleaner WordPress plugin (versions before 7.2 ) is vulnerable to an authorization bypass due to a missing capability check and nonce validation on a bulk comment-deletion routine (specifically via nav_delete_all_comment). This allows authenticated users with minimal permissions, su...

CVE-2026-107791 WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site...

CVE-2026-104915 Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo...

CVE-2026-104915

The Academy LMS plugin for WordPress (versions

WordPress Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion vulnerability

Missing Authorization to Authenticated Custom+ Arbitrary Academy Comment Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Academy LMS versions = 4.0.3...

CVE-2026-87839

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

EUVD-2026-83672

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

WordPress Tripzzy plugin < 1.5.1 - Unauthenticated Arbitrary Comment Deletion vulnerability

Unauthenticated Arbitrary Comment Deletion vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Tripzzy Travel Engine System versions 1.5.1...

CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-87839

The Tripzzy WordPress plugin (versions before 1.5.1 ) contains an improper access control vulnerability. The root cause is a lack of authorization checks and failure to validate the identifier of the object being removed within an AJAX action . Because this action is accessible to unauthenticated...

CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

PT-2026-95925

Name of the Vulnerable Software and Affected Versions Tripzzy versions prior to 1.5.1 Description An AJAX action available to unauthenticated users lacks authorization checks and fails to validate the identifier of the object being removed. This allows an attacker to permanently delete arbitrary...

CVE-2026-87839: Improper Access Control

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...

CVE-2026-89262

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields instead of the authenticated principal. Attackers can delete arbitrary comments and their replies by supplying comment UIDs and author UI...