Unauthenticated Comment Deletion in Tripzzy WordPress Plugin

The Tripzzy WordPress plugin before version 1.5.1 contains a critical authorization bypass vulnerability that allows unauthenticated attackers to permanently delete arbitrary comments from affected websites. The vulnerability stems from missing authorization checks and insufficient input validation in an AJAX action endpoint, enabling any user—including those without any account credentials—to submit requests that delete comments by manipulating object identifiers. This affects all WordPress sites running the vulnerable plugin version, potentially impacting content integrity, user engagement, and site reputation as attackers can selectively remove legitimate user comments, feedback, or reviews without authentication.

While this CVE has no direct MITRE ATT&CK technique mapping, Casky's Claude-powered security skills would identify the underlying attack patterns through detection of CWE-284 (Improper Access Control) violations. Practitioners using Casky would observe findings related to unauthenticated action execution, improper privilege enforcement, and object-level authorization failures. The platform's extended reasoning capability would help security teams recognize the attack chain: reconnaissance of AJAX endpoints, exploitation of missing auth checks, and privilege escalation through anonymous access. A Casky analysis would flag the absence of nonce verification, capability checks (is_user_logged_in), and object ownership validation—key defensive controls—allowing practitioners to remediate similar authorization flaws across their WordPress infrastructure before exploitation occurs.