CVE-2026-106029: high-severity vulnerability in WeddingCity Lite
WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.5epss 0.3%
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
Unknown · WeddingCity Litepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/7a08e8fd-9795-4aac-b023-5e75b741400b/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.