{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87839", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-09-09T11:22:36.182Z", "datePublished": "2026-09-20T06:00:17.654Z", "dateUpdated": "2026-09-20T06:00:17.654Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-09-20T06:00:17.654Z"}, "title": "Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion", "problemTypes": [{"descriptions": [{"description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Tripzzy", "versions": [{"status": "affected", "versionType": "semver", "version": "1.1.8", "lessThan": "1.5.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site."}], "references": [{"url": "https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Pablo Gonz\u00e1lez P\u00e9rez", "type": "finder"}, {"lang": "en", "value": "Francisco Jos\u00e9 Ram\u00edrez Vicente and I\u00f1igo S\u00e1nchez Enciso", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tripzzy", "vendor": "Unknown", "versions": [{"lessThan": "1.5.1", "status": "affected", "version": "1.1.8", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site."}], "id": "CVE-2026-87839", "lastModified": "2026-09-20T07:16:50.760", "metrics": {}, "published": "2026-09-20T07:16:50.760", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{}