A critical access control vulnerability in the Tripzzy WordPress plugin allows unauthenticated attackers to delete site comments, posing a significant risk to data integrity.

This vulnerability is an improper access control flaw (CWE-284) within an AJAX action that lacks necessary capability checks. Because the endpoint does not validate user identity or permissions, any unauthenticated attacker can invoke the function to remove comments from the site.

The ability for unauthorized parties to delete content directly threatens the integrity of site data and user engagement metrics. Given the CVSS score of 7.5, this high-severity vulnerability could lead to mass content removal, resulting in reputational damage and the loss of historical discourse on the affected platform.

Immediate Action: Update the Tripzzy WordPress plugin to version 1.5.1 or later immediately to incorporate the required authorization checks.

Proactive Monitoring: Review web server logs for suspicious POST requests targeting AJAX endpoints, specifically looking for repeated calls that do not correspond to legitimate user activity.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the vulnerable AJAX endpoints until the plugin can be patched.

Public Exploit Available: Unknown

The severity of this issue necessitates an immediate update to the latest version of the Tripzzy plugin. Administrators should prioritize this patch to prevent unauthorized data destruction, as the lack of authentication requirements makes the vulnerability trivial to exploit for any remote attacker.