EUVD-2026-83672
GHSA-2g8q-36c3-9gj4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network AJAX action with no authz (PR:N/UI:N/AC:L); permanent deletion of arbitrary comments is an integrity impact (I:H) with no confidentiality or platform availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
6DescriptionCVE.org
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.
Articles & Coverage 1
AnalysisAI
Unauthenticated comment deletion in the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1) lets any remote attacker permanently delete arbitrary comments on an affected site with a single crafted request. The plugin's AJAX action is registered for unauthenticated users by design but performs neither an authorization/capability check nor validation of the comment identifier being removed, so it is a textbook missing-authorization plus IDOR weakness (CWE-284, CVSS 3.1 7.5 HIGH, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default installations of the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, base 7.5 HIGH) is internally consistent with the description: a network-reachable AJAX action exposed to unauthenticated users with no authorization check and no validation of the target object identifier (an IDOR combined with missing authorization, CWE-284). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Tripzzy to version 1.5.1 or later - this is the only complete fix, and it should be applied immediately given that publicly available exploit code exists and no authentication, user interaction, or non-default configuration is required to trigger the flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every WordPress instance running the Tripzzy plugin and confirm which are on versions 1.1.8 through 1.5.0, treating any internet-facing site as the priority; where possible, temporarily deactivate the plugin or block unauthenticated access to its AJAX endpoints via WAF rules until upgrading is feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today