CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...

CVE-2026-87840

CVE-2026-87840 affects the Tripzzy WordPress plugin in versions before 1.5.1 . The plugin fails to perform any capability or ownership checks on its administrative booking-management actions, which are exposed to unauthenticated users and gated only by a token the plugin issues to any anonymous v...