CVE-2026-106029 — WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion

CVE-2026-106029

WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion PUBLISHED

Description (CNA)

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

Affected (CNA)

Vendor / product	Versions
Unknown / WeddingCity Lite	affected 0 through 1.0.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/7a08e8fd-9795-4aac-b023-5e75b741400b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.