EUVD-2026-83673
GHSA-8988-mvh8-r5v8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRequest anonymous token from plugin
-
ExploitCall booking-management action with token
-
ExecutionBypass missing capability/ownership check
-
ImpactAlter arbitrary booking totals/contents/notes
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required - the plugin's booking-management actions are exposed to unauthenticated users by default and gated only by a token the plugin issues to any anonymous visitor on request, so any internet-reachable WordPress site running Tripzzy in the vulnerable range (1.3.4 up to but not including 1.5.1) is exploitable remotely without credentials or user interaction. The only meaningful limiting factors are product prevalence (niche travel-booking plugin) and impact scope: exploitation permits altering booking contents, stored totals, and notes (integrity), but the description does not establish confidentiality or availability impact. |
| Impact | This is a real but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) reflects the key aggravating factor - genuinely unauthenticated network exploitation with low complexity and no user interaction - offset by the fact that impact is integrity-only and limited (I:L, with C:N and A:N). The plugin's 'security' control is illusory: administrative booking-management actions perform no capability or ownership check and are gated solely by a token that the plugin hands to any anonymous visitor on request, so PR:N is well-justified. A public exploit exists (WPScan) and a vendor patch (1.5.1) is available, which raises the practical priority for exposed sites, but there is no EPSS score and no CISA KEV entry provided. Signals are consistent rather than conflicting: low technical impact plus a niche product footprint means this is not a mass-exploitation candidate, but the trivial unauth reach and public POC make it worth patching promptly on any live Tripzzy site handling real bookings. Note the description implies attackers can also read/alter booking totals and notes; the vendor scored C:N (alteration only), which is defensible but slightly understates data-tampering blast radius. |
| Exploit ScenarioDerived | An unauthenticated attacker requests the anonymous token the plugin freely issues, then invokes the administrative booking-management AJAX/action endpoints to modify arbitrary bookings - rewriting stored totals (e.g. zeroing a trip price), altering booking contents, or injecting notes. A public proof-of-concept is available via WPScan, and because no authentication or user interaction is required, the request can be scripted directly against any exposed Tripzzy site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 20, 2026
Unauthenticated attackers can tamper with arbitrary bookings on any internet-reachable WordPress site running the Tripzzy plugin in versions 1.3.4 through 1.5.0, because its administrative booking-management actions perform no capability or ownership checks and are gated only by a token the plugin hands to any anonymous visitor on request. Exploitation allows alteration of booking contents, stored totals, and notes (integrity impact only; no confidentiality or availability impact was assessed), and publicly available exploit code exists - the WPScan entry is tagged as an exploit reference. No special configuration is required, no credentials or user interaction are needed, and there is no indication of confirmed active exploitation in CISA KEV at the time of analysis; EPSS data was not provided.
RemediationAI
Vendor-released patch: upgrade the Tripzzy plugin to version 1.5.1 (or later), which is the first version outside the affected range of 1.3.4 through 1.5.0; verify the update completed and remove any leftover vulnerable copies, and confirm against the WPScan advisory (https://wpscan.com/vulnerability/7a81fd1d-9df5-4521-9a32-31fc9fe77960/) or the CVE record (https://nvd.nist.gov/vuln/detail/CVE-2026-87840). If immediate patching is not possible, the most effective compensating control is to deactivate the Tripzzy plugin entirely until it can be updated - the trade-off is loss of the booking functionality on the site. Where the plugin must stay live, restrict the booking-management action endpoints to trusted sources at the web server or WAF layer (allow only known administrator IP ranges or block the action routes for anonymous sessions), understanding that this may also break legitimate guest-facing booking flows if those routes are shared with customer interactions; note that token-based gating is not an adequate control here because the token is issued to any anonymous visitor on request. Additionally, enable logging and integrity monitoring on booking records (contents, stored totals, notes) to detect unauthorized modification, and deactivate and remove the plugin entirely if it is unused, since deactivation eliminates the attack surface with no functional cost.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-284 (Improper Access Control): Tripzzy's administrative booking-management handlers omit both WordPress capability checks (e.g., current_user_can) and per-object ownership validation, so the actions are reachable outside the intended privileged context. Compounding this, the plugin exposes those handlers to unauthenticated users and relies solely on a nonce-like token that it issues to any anonymous visitor on request - a value an attacker can simply obtain before calling the action, so the token provides no real authorization boundary. The CPE string (cpe:2.3:a:unknown:tripzzy:*:*:*:*:*:*:*:*) confirms a plugin-level component with an unassigned vendor namespace; the vulnerable code is the booking management action layer of the plugin, as installed on a WordPress site. Impact is scoped to write operations on booking records: contents, stored totals, and notes can be modified. The assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated path with only partial integrity loss and no scope change.
Know when Tripzzy gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated, low-complexity, no-interaction network access (token freely issued to anyone) justifies PR:N/AC:L/UI:N; impact is limited data tampering, so I:L with C:N and A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB