CVE-2026-87840: Tripzzy WordPress Plugin Auth Bypass

CVE-2026-87840 Overview

CVE-2026-87840 affects the Tripzzy WordPress plugin in versions before 1.5.1. The plugin exposes administrative booking-management actions to unauthenticated users without capability or ownership checks. Access is gated only by a token that the plugin issues to any anonymous visitor on request. Attackers can abuse this weak access control to alter the contents, stored totals, and notes of arbitrary bookings. The flaw is categorized under [CWE-284] Improper Access Control and stems from missing authorization on sensitive endpoints.

Critical Impact
Unauthenticated attackers can modify arbitrary Tripzzy booking records, including stored totals and notes, by obtaining a freely issued token and invoking administrative actions.

Affected Products

Tripzzy WordPress plugin versions prior to 1.5.1
WordPress sites running the vulnerable plugin with booking functionality enabled
Any environment exposing the plugin's booking-management endpoints to the internet

Discovery Timeline

2026-09-20 - CVE-2026-87840 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-87840

Vulnerability Analysis

The Tripzzy plugin exposes booking-management actions intended for administrators without enforcing capability checks or ownership validation. Instead of relying on WordPress current_user_can() checks or nonce-bound sessions tied to authenticated administrators, the plugin issues a token to any anonymous requester. That token then acts as the sole gate to sensitive booking operations.

Because the token is issued on demand to unauthenticated visitors, it does not function as a meaningful authorization boundary. Any attacker can request a valid token and use it to invoke administrative booking actions. The result is unauthorized modification of booking records belonging to other users, including changes to stored totals and internal notes.

The integrity impact is limited to booking data; the vulnerability does not enable information disclosure or denial of service according to the published vector. However, tampering with stored totals in a travel-booking context can produce direct financial consequences for site operators and customers.

Root Cause

The root cause is broken access control [CWE-284]. The plugin conflates possession of an anonymously issued token with authorization to perform administrative booking actions. It omits both capability checks (verifying the caller holds an administrative role) and ownership checks (verifying the caller owns the booking being modified).

Attack Vector

An attacker sends an unauthenticated request to obtain a token from the plugin. Using that token, the attacker then invokes the booking-management endpoints and supplies arbitrary booking identifiers along with modified content, totals, or notes. No authentication, user interaction, or elevated privileges are required. The attack is remotely exploitable over the network.

No verified public proof-of-concept code is available at this time. Technical details are described in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-87840

Indicators of Compromise

Unexpected modifications to booking records, stored totals, or admin notes without a corresponding authenticated administrator session in access logs.
HTTP requests to Tripzzy plugin AJAX or REST endpoints originating from unauthenticated sessions that include booking-management action parameters.
Repeated token-issuance requests from a single IP followed by booking-management calls referencing multiple distinct booking IDs.

Detection Strategies

Correlate web server access logs with WordPress user-session data to flag booking-modification actions performed without an authenticated administrator context.
Monitor for anomalous sequences of token issuance followed by rapid, sequential booking-management calls, which suggests enumeration.
Enable WordPress database auditing on booking-related tables to record row-level changes with timestamps and originating request identifiers.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized SIEM or data lake with retention sufficient to reconstruct booking-modification sequences.
Alert on modifications to booking totals or notes that deviate from historical baselines by user or IP.
Track outbound webhook or notification traffic tied to booking updates to detect unauthorized changes downstream.

How to Mitigate CVE-2026-87840

Immediate Actions Required

Upgrade the Tripzzy WordPress plugin to version 1.5.1 or later on all affected sites.
Audit the wp_posts, wp_postmeta, and any Tripzzy-specific booking tables for unauthorized modifications since the plugin was installed.
Rotate any API keys, payment integration credentials, or webhook secrets that could have been referenced in tampered booking records.

Patch Information

The vendor has released Tripzzy version 1.5.1, which addresses the missing capability and ownership checks on administrative booking-management actions. Site administrators should apply this update through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable the Tripzzy plugin on public-facing sites until the patch is applied.
Restrict access to the plugin's AJAX and REST endpoints at the web application firewall (WAF) layer, blocking unauthenticated requests to booking-management actions.
Place the WordPress admin and plugin endpoints behind IP allowlisting or an authenticating reverse proxy while remediation is in progress.

bash

# Example WAF rule concept: block unauthenticated access to Tripzzy booking-management actions
# Adjust action names to match plugin endpoints identified in access logs
SecRule REQUEST_URI "@rx /wp-admin/admin-ajax\.php" \
  "chain,deny,status:403,id:1008701,msg:'Block unauthenticated Tripzzy booking action'"
  SecRule ARGS:action "@rx ^tripzzy_(update|edit|modify)_booking" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"