EUVD-2026-83673
GHSA-8988-mvh8-r5v8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated, low-complexity, no-interaction network access (token freely issued to anyone) justifies PR:N/AC:L/UI:N; impact is limited data tampering, so I:L with C:N and A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
AnalysisAI
Unauthenticated attackers can tamper with arbitrary bookings on any internet-reachable WordPress site running the Tripzzy plugin in versions 1.3.4 through 1.5.0, because its administrative booking-management actions perform no capability or ownership checks and are gated only by a token the plugin hands to any anonymous visitor on request. Exploitation allows alteration of booking contents, stored totals, and notes (integrity impact only; no confidentiality or availability impact was assessed), and publicly available exploit code exists - the WPScan entry is tagged as an exploit reference. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required - the plugin's booking-management actions are exposed to unauthenticated users by default and gated only by a token the plugin issues to any anonymous visitor on request, so any internet-reachable WordPress site running Tripzzy in the vulnerable range (1.3.4 up to but not including 1.5.1) is exploitable remotely without credentials or user interaction. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a real but moderate-priority issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the Tripzzy plugin to version 1.5.1 (or later), which is the first version outside the affected range of 1.3.4 through 1.5.0; verify the update completed and remove any leftover vulnerable copies, and confirm against the WPScan advisory (https://wpscan.com/vulnerability/7a81fd1d-9df5-4521-9a32-31fc9fe77960/) or the CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-87840). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today