EUVD-2026-83672
GHSA-2g8q-36c3-9gj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable Tripzzy
-
DeliverySend unauthenticated AJAX request with target comment ID
-
ExploitMissing authz check accepts request
-
ExecutionPlugin permanently deletes arbitrary comment
-
ImpactIterate over IDs to wipe all comments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default installations of the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1). The vulnerable AJAX action is exposed to unauthenticated users by design, so the only requirement is a reachable WordPress site running an affected version; no authentication, user interaction, or non-default configuration is needed. The limiting factor is impact scope: exploitation only permits permanent deletion of comments (integrity/data-loss), not code execution, privilege escalation, or data exfiltration. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5 HIGH) is internally consistent with the description: a network-reachable AJAX action exposed to unauthenticated users with no authorization check and no validation of the target object identifier (an IDOR combined with missing authorization, CWE-284). Exploitation is trivial - no privileges, no user interaction, low complexity - and publicly available exploit code exists (WPScan). The impact is integrity-only (I:H): permanent, irreversible deletion of arbitrary site comments; there is no confidentiality or availability impact to the platform itself, which is why C:N/A:N is appropriate and the 'HIGH' rating is driven entirely by the ease of unauthenticated access rather than by severe technical impact. No EPSS score and no KEV entry were provided in the input, so there is no evidence of active or widespread exploitation; the risk profile is 'easy to exploit, low-to-moderate business impact.' The realistic priority is moderate: patch promptly because it is unauthenticated and weaponizable at scale, but the blast radius is limited to comment data destruction rather than site takeover or data theft. |
| Exploit ScenarioDerived | An unauthenticated attacker enumerates comment IDs and sends crafted requests to the plugin's unprotected admin-ajax action, causing the site to permanently delete each targeted comment. Because a public exploit is available from WPScan and no authentication or user interaction is required, an attacker could script bulk deletion of all comments across any vulnerable Tripzzy site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Unauthenticated comment deletion in the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1) lets any remote attacker permanently delete arbitrary comments on an affected site with a single crafted request. The plugin's AJAX action is registered for unauthenticated users by design but performs neither an authorization/capability check nor validation of the comment identifier being removed, so it is a textbook missing-authorization plus IDOR weakness (CWE-284, CVSS 3.1 7.5 HIGH, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Publicly available exploit code exists, but the impact is bounded: exploitation only yields permanent integrity/data loss of comment content, with no code execution, privilege escalation, or data exfiltration, and the vendor has shipped a fix in version 1.5.1.
RemediationAI
Vendor-released patch: upgrade Tripzzy to version 1.5.1 or later - this is the only complete fix, and it should be applied immediately given that publicly available exploit code exists and no authentication, user interaction, or non-default configuration is required to trigger the flaw. Where an immediate upgrade is impossible, deactivate the Tripzzy plugin entirely (accepting the functional loss of its trip/booking features), or, if the site must keep it running, add a WAF rule that rejects unauthenticated POST requests to /wp-admin/admin-ajax.php carrying the plugin's comment-deletion action parameter - the trade-off is that legitimate unauthenticated front-end AJAX features of the plugin may also break and the rule requires tuning against your traffic, plus it does not stop an attacker already inside your perimeter. Additionally, treat any affected site as having suffered possible data loss: audit comment tables for unexplained deletions and restore affected comments from backup, since the deletion is permanent. Track the vendor advisory at https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/ for any updated fixed versions or interim guidance; do not rely on CPE-based inventory checks for this plugin, as the CPE vendor field is unpopulated, and instead match installed plugin version numbers against the affected range.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Tripzzy is a WordPress plugin that exposes functionality through WordPress's AJAX dispatcher (admin-ajax.php), where handlers are registered via wp_ajax_* (authenticated) and wp_ajax_nopriv_* (unauthenticated) hooks. The vulnerable handler falls into the nopriv category, meaning it is intentionally reachable without a session, but it omits the two controls that WordPress normally relies on: a capability/ownership check (e.g. current_user_can() or a comment-ownership test) and request-origin protection (check_ajax_referer() nonce verification). It also fails to validate the attacker-supplied object identifier, so the comment ID parameter is trusted verbatim and passed to comment-deletion logic. The result is an improper access control flaw (CWE-284) specifically manifesting as an insecure direct object reference: the caller is anonymous, yet the identifier determines what is destroyed. Per the CPE data (cpe:2.3:a:unknown:tripzzy:*:*:*:*:*:*:*:*) the vendor is not normalized in the NVD CPE dictionary, so CPE-based scanning will not reliably match this plugin's installations; version-range matching against the EUVD data (1.1.8 up to but not including 1.5.1) is the dependable identification path. The assessed CVSS vector is internally consistent with the root cause: network-reachable, low complexity, no privileges, no user interaction, and impact confined to integrity (I:H) with no confidentiality or availability component.
Know when Tripzzy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network AJAX action with no authz (PR:N/UI:N/AC:L); permanent deletion of arbitrary comments is an integrity impact (I:H) with no confidentiality or platform availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
Articles & Coverage 1
Technical POC Analysis
Evidence limitation, stated up front: the supplied evidence is the WPScan advisory only.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Tripzzy plugin used on our WordPress sites contains a missing-authorization flaw that allows anyone on the internet to permanently erase visitor comments without logging in. Because comment removal is irreversible and requires no credentials, an attacker could quietly strip discussions, testimonials, or user feedback from any page running Tripzzy versions 1.1.8 through 1.5.0 at scale, with publicly available exploit code already circulating. Leadership should care because the exposure is reputational and content-integrity related rather than a system compromise, and the fix is a straightforward plugin upgrade.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB