Unrated severityNVD Advisory· Published Sep 20, 2026

CVE-2026-87839

Description

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000