What is GHSA-2g8q-36c3-9gj4?

GHSA-2g8q-36c3-9gj4 is a security advisory published by GitHub Security Advisories with High severity. The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not...

Which CVE IDs does GHSA-2g8q-36c3-9gj4 cover?

GHSA-2g8q-36c3-9gj4 covers the following CVE IDs: CVE-2026-87839. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2g8q-36c3-9gj4?

GHSA-2g8q-36c3-9gj4 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-2g8q-36c3-9gj4HighCVSS 7.5

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not...

Vendor

GitHub Security Advisories

Published

September 20, 2026

Last Modified

September 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-87839 →

📋 Description

The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being removed, in an AJAX action available to unauthenticated users, allowing them to permanently delete arbitrary comments on the site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87839
https://wpscan.com/vulnerability/e5145602-cb5e-4ef9-a51b-8f161200d014
https://github.com/advisories/GHSA-2g8q-36c3-9gj4