UNKNOWN NVD

CVE-2026-87839

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX acti

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

References

https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/

Published: 2026-09-20 · Source: NVD · Feed updated: 2026-09-20

This unknown severity vulnerability was published on 2026-09-20 via NVD.

vulnfeed aggregates 14846 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.