CVE-2026-87839: Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Tripzzy pluginto a version that resolves this vulnerability.Fixed in 1.5.1 - Compensating control
Temporarily restrict unauthenticated access to the affected AJAX action endpoint (block at the web server/WAF/edge) until the Tripzzy plugin is upgraded to 1.5.1, to prevent unauthenticated users from deleting comments.
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Sites using the Tripzzy WordPress plugin in versions before 1.5.1 are exposed. The vulnerable AJAX action is available to unauthenticated users, so an attacker does not need a WordPress account.
What does an attacker need to delete comments?
An attacker only needs to send requests to the affected unauthenticated AJAX action and provide an identifier for a comment. Because the identifier is not validated and authorization checks are absent, arbitrary site comments can be permanently deleted.
Does this affect only comments created through Tripzzy?
No. The issue allows deletion of arbitrary comments on the site; the available information does not limit impact to comments associated with Tripzzy.
How can administrators determine whether they are affected?
Check whether the Tripzzy plugin is installed and whether its version is earlier than 1.5.1. Sites running an earlier version should treat their comments as at risk of unauthorized permanent deletion.