CVE-2026-87839
Deferred Deferred - Pending Action

Unauthenticated Comment Deletion in Tripzzy WordPress Plugin

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: WPScan

Description
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-10-10
AI Q&A
2026-09-20
EPSS Evaluated
2026-10-09
NVD
CVE-2026-87839
EUVD
EUVD-2026-83672

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tripzzy wordpress_plugin to 1.5.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Tripzzy WordPress plugin before version 1.5.1 has a flaw where unauthenticated users can delete any comments on a site. This happens because the plugin lacks proper authorization checks and does not validate the comment ID being removed in an AJAX action accessible to all users.

Detection Guidance

Check if the Tripzzy WordPress plugin version is 1.5.1 or earlier. Look for unauthorized comment deletions in WordPress logs or database. Monitor AJAX requests to identify suspicious activity targeting comment removal endpoints.

Impact Analysis

Attackers can permanently delete comments on your WordPress site without needing access. This could remove user-generated content, disrupt site functionality, or damage reputation if critical comments are lost.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized deletion of comments, which may include user data or protected health information. Unauthorized deletion of comments could violate data integrity and access control requirements under these regulations.

Mitigation Strategies

Update the Tripzzy plugin to version 1.5.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review WordPress user roles and permissions to ensure only authorized users can delete comments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart