CVE-2026-87840: Unknown Tripzzy

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.

Affected products

• Unknown Tripzzy: from 1.3.4, before 1.5.1 (fixed in 1.5.1)

Published 2026-09-20. Last modified 2026-09-21.