CVE-2026-87840

The Tripzzy WordPress plugin (versions before 1.5.1 ) contains an improper access control vulnerability allowing unauthenticated booking data tampering. The plugin fails to perform necessary capability or ownership checks on administrative booking-management actions. These actions are exposed to ...

CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...

CVE-2026-87840 Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visit...