Description

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-20T07:16:50.760Z",
  "pubdate": "2026-09-20T07:16:50.760Z",
  "executiveSummary": "The Tripzzy WordPress plugin prior to version 1.5.1 contains a critical security flaw involving Improper Authorization and Broken Access Control within its AJAX functionality.\nThis vulnerability allows unauthenticated remote attackers to delete arbitrary comments from the WordPress database, resulting in a denial-of-service condition for site content and potential reputation damage.\nThe vulnerability stems from the absence of security nonces, permission checks, and object identifier validation within the affected AJAX action.\nBecause the vulnerability is exploitable by unauthenticated users without any interaction or prior knowledge of the target site's administrative credentials, the risk is severe.\nAttackers can leverage this flaw to programmatically remove large volumes of user-generated content or sensitive discourse from the site.",
  "technicalDetails": "The vulnerability is located within the AJAX endpoint provided by the Tripzzy plugin. The application fails to implement mandatory WordPress security practices, specifically the verification of cryptographic nonces intended to protect against Cross-Site Request Forgery (CSRF) and unauthorized access.\nFurthermore, the function responsible for handling the comment deletion process lacks sufficient server-side authorization checks. It does not verify whether the current user has the required capabilities (e.g., 'edit_comments' or 'moderate_comments') before executing the deletion operation.\nThe root cause is the reliance on user-supplied input to identify the object for removal without validating that the target is within the scope of the current request or that the requester possesses appropriate privileges.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies the specific AJAX action used by the Tripzzy plugin for comment management. By constructing a crafted HTTP request (typically a POST request) containing the identifier of a target comment, the attacker can invoke the vulnerable function.\nBecause the server-side code does not validate session tokens, nonces, or user capabilities, it processes the request and executes the database command necessary to remove the specified comment. Since the object identifier is not validated against a secure lookup, the attacker can iterate through sequential ID numbers to delete arbitrary comments across the entire WordPress site.\nThis vulnerability is classified as an authorization bypass. The lack of restriction allows any remote user on the network to perform actions reserved for administrators or moderators. The impact is significant, as it leads to an irreversible loss of site data and the potential destruction of community feedback or support history. The plugin version affected is strictly prior to 1.5.1, and all WordPress instances utilizing this version are exposed to this unauthenticated deletion vector."
}