{"id":"CVE-2026-106029","published":"2026-10-11T07:17:22.963","lastModified":"2026-10-13T20:36:00.850","description":"The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/7a08e8fd-9795-4aac-b023-5e75b741400b/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WeddingCity Lite WordPress plugin allows unauthenticated users to delete any posts, pages, or media attachments on a site. This authorization flaw enables attackers to permanently remove arbitrary content without needing any credentials.","exploitability":"Exploitation is straightforward requiring no prerequisites beyond access to the vulnerable plugin's deletion endpoint, making it highly exploitable by anyone who can reach the WordPress site.","blast_radius":"The impact could be significant as attackers can delete all content across the entire website including important pages, blog posts, and media files, potentially causing complete loss of site data and functionality.","remediation":"Disable the WeddingCity Lite plugin immediately or upgrade to version 1.0.5 which fixes this authorization issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["wp-plugin","content-deletion","auth-bypass"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:10:50.697Z"}}