---
id: CVE-2026-106029
title: >-
  The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any
  authorisation or validity checks before deleting posts, pages and media
  attachments, allowing unauthenticated attackers to permanently delete
  arbitrary content sit…
summary: >-
  The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any
  authorisation or validity checks before deleting posts, pages and media
  attachments, allowing unauthenticated attackers to permanently delete
  arbitrary content sit…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-862
published: '2026-10-11'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:36:00.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106029'
references:
  - url: 'https://wpscan.com/vulnerability/7a08e8fd-9795-4aac-b023-5e75b741400b/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00253
epssPercentile: 0.1678
ingestedAt: '2026-10-11T08:44:24.710Z'
product: WeddingCity Lite
affected:
  - weddingcity_lite <= 1.0.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-11T11:28:52.633041Z'
---

## Overview

The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.