CVE-2026-87839
Received Received - Intake

Unauthenticated Comment Deletion in Tripzzy WordPress Plugin

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: WPScan

Description
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-20
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-87839
EUVD
EUVD-2026-83672

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tripzzy wordpress_plugin to 1.5.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Tripzzy WordPress plugin before version 1.5.1 has a flaw where unauthenticated users can delete any comments on a site. This happens because the plugin lacks proper authorization checks and does not validate the comment ID being removed in an AJAX action accessible to all users.

Detection Guidance

Check if the Tripzzy WordPress plugin version is 1.5.1 or earlier. Look for unauthorized comment deletions in WordPress logs or database. Monitor AJAX requests to identify suspicious activity targeting comment removal endpoints.

Impact Analysis

Attackers can permanently delete comments on your WordPress site without needing access. This could remove user-generated content, disrupt site functionality, or damage reputation if critical comments are lost.

Mitigation Strategies

Update the Tripzzy plugin to version 1.5.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review WordPress user roles and permissions to ensure only authorized users can delete comments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87839. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart