Tripzzy
Monthly
Unauthenticated comment deletion in the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1) lets any remote attacker permanently delete arbitrary comments on an affected site with a single crafted request. The plugin's AJAX action is registered for unauthenticated users by design but performs neither an authorization/capability check nor validation of the comment identifier being removed, so it is a textbook missing-authorization plus IDOR weakness (CWE-284, CVSS 3.1 7.5 HIGH, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Publicly available exploit code exists, but the impact is bounded: exploitation only yields permanent integrity/data loss of comment content, with no code execution, privilege escalation, or data exfiltration, and the vendor has shipped a fix in version 1.5.1.
Unauthenticated attackers can tamper with arbitrary bookings on any internet-reachable WordPress site running the Tripzzy plugin in versions 1.3.4 through 1.5.0, because its administrative booking-management actions perform no capability or ownership checks and are gated only by a token the plugin hands to any anonymous visitor on request. Exploitation allows alteration of booking contents, stored totals, and notes (integrity impact only; no confidentiality or availability impact was assessed), and publicly available exploit code exists - the WPScan entry is tagged as an exploit reference. No special configuration is required, no credentials or user interaction are needed, and there is no indication of confirmed active exploitation in CISA KEV at the time of analysis; EPSS data was not provided.
Unauthenticated comment deletion in the Tripzzy WordPress plugin (versions 1.1.8 through before 1.5.1) lets any remote attacker permanently delete arbitrary comments on an affected site with a single crafted request. The plugin's AJAX action is registered for unauthenticated users by design but performs neither an authorization/capability check nor validation of the comment identifier being removed, so it is a textbook missing-authorization plus IDOR weakness (CWE-284, CVSS 3.1 7.5 HIGH, vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Publicly available exploit code exists, but the impact is bounded: exploitation only yields permanent integrity/data loss of comment content, with no code execution, privilege escalation, or data exfiltration, and the vendor has shipped a fix in version 1.5.1.
Unauthenticated attackers can tamper with arbitrary bookings on any internet-reachable WordPress site running the Tripzzy plugin in versions 1.3.4 through 1.5.0, because its administrative booking-management actions perform no capability or ownership checks and are gated only by a token the plugin hands to any anonymous visitor on request. Exploitation allows alteration of booking contents, stored totals, and notes (integrity impact only; no confidentiality or availability impact was assessed), and publicly available exploit code exists - the WPScan entry is tagged as an exploit reference. No special configuration is required, no credentials or user interaction are needed, and there is no indication of confirmed active exploitation in CISA KEV at the time of analysis; EPSS data was not provided.