CVE-2026-87840: Tripzzy < 1.5.1 - Unauthenticated Booking Data Tampering
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote visitor can exploit it. The affected administrative booking-management actions are exposed without capability or booking-ownership checks, and the required token can be requested by an anonymous visitor.
What booking data can be changed?
An attacker can alter arbitrary bookings, including their contents, stored totals, and notes.
Are installations running version 1.5.1 affected?
The issue affects Tripzzy versions before 1.5.1. The provided information does not identify any affected configuration requirements beyond running a version earlier than 1.5.1.