8 matches found
CVE-2026-87839
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...
CVE-2026-87840
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...
CVE-2026-87839 Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...
CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...
EUVD-2026-83673
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...
CVE-2026-87840
CVE-2026-87840 affects the Tripzzy WordPress plugin in versions before 1.5.1 . The plugin fails to perform any capability or ownership checks on its administrative booking-management actions, which are exposed to unauthenticated users and gated only by a token the plugin issues to any anonymous v...
EUVD-2026-83672
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site...
CVE-2026-87839
Tripzzy WordPress plugin versions before 1.5.1 expose an AJAX action to unauthenticated users that lacks both authorization checks and validation of the target object's identifier. An unauthenticated attacker can therefore permanently delete arbitrary comments on a site, resulting in a HIGH (7.5)...