CVE-2026-106029

Deferred Deferred - Pending Action

Unauthenticated Post Deletion in WeddingCity Lite WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-13

Assigner: WPScan

Description

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-11

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-11

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106029

EUVD

EUVD-2026-96743

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	WeddingCity	Lite 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The WeddingCity Lite WordPress plugin through version 1.0.4 has a vulnerability where it fails to perform authorization or validity checks before deleting posts, pages, and media attachments. This allows unauthenticated attackers to permanently delete any content on the site without needing access or permissions.

Detection Guidance

To detect this vulnerability, check if the WeddingCity Lite plugin version 1.0.4 or earlier is installed on your WordPress site. Inspect server logs for unusual deletion activities or unauthorized POST requests targeting post, page, or media endpoints.

Impact Analysis

This vulnerability can lead to permanent loss of critical website content such as posts, pages, and media files. Attackers could delete important data, disrupting website functionality and causing data loss for all users.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized deletion of personal or sensitive data. GDPR requires data integrity and access controls, while HIPAA mandates protection of health information. Unauthorized deletion violates these requirements.

Mitigation Strategies

Immediately disable or uninstall the WeddingCity Lite plugin if installed. Monitor your site for unauthorized deletions and restrict access to administrative functions until an official patch is released.

Hi! I’m here to help you understand CVE-2026-106029. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70