CVE-2026-87840

MediumCVSS 5.3/10Last modified Sep 21, 2026

Description

The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actions, which are additionally exposed to unauthenticated users and gated only by a token the Tripzzy WordPress plugin before 1.5.1 issues to any anonymous visitor on request, allowing unauthenticated attackers to alter the contents, stored totals and notes of arbitrary bookings.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Unknown	Tripzzy	>= 1.3.4, < 1.5.1

References

https://wpscan.com/vulnerability/7a81fd1d-9df5-4521-9a32-31fc9fe77960/

Timeline

Published: Sep 20, 2026
Last modified: Sep 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-878415.3The UnitechPay WordPress plugin through 1.0.6.3 does not verify the authenticity of the payment notifications it receives, allowing unauthe CVE-2026-878427.5The Zonify WordPress plugin before 1.0.5 does not perform any capability or authentication check before returning the site's stored account CVE-2026-878436.5The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response CVE-2026-878445.3The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verific CVE-2026-878465.3The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, nonce or ownership checks on one of its AJA CVE-2026-878483.7The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions availabl CVE-2026-87849The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON valu CVE-2026-87857.3A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the function getAllPatientDe CVE-2026-878537.5A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strn CVE-2026-878545.3The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST end CVE-2026-878559.8The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 vi CVE-2026-878587.2Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated calle