CVE-2026-106029

Summary

The WeddingCity Lite WordPress plugin allows unauthenticated users to delete any posts, pages, or media attachments on a site. This authorization flaw enables attackers to permanently remove arbitrary content without needing any credentials.

Exploitability

Exploitation is straightforward requiring no prerequisites beyond access to the vulnerable plugin's deletion endpoint, making it highly exploitable by anyone who can reach the WordPress site.

Blast radius

The impact could be significant as attackers can delete all content across the entire website including important pages, blog posts, and media files, potentially causing complete loss of site data and functionality.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the WeddingCity Lite plugin immediately or upgrade to version 1.0.5 which fixes this authorization issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.