Tripzzy WP Plugin < 1.5.1: Unauth AJAX Allows Comment Deletion
CVE-2026-87839 Published on September 20, 2026

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.