---
id: CVE-2026-106029
title: >-
  The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any
  authorisation or validity checks before deleting posts, pages and media
  attachments, allowing unauthenticated attackers to permanently delete
  arbitrary content sit…
summary: >-
  The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any
  authorisation or validity checks before deleting posts, pages and media
  attachments, allowing unauthenticated attackers to permanently delete
  arbitrary content sit…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-862
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:16:52.337'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106029'
references:
  - url: 'https://wpscan.com/vulnerability/7a08e8fd-9795-4aac-b023-5e75b741400b/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.710Z'
epss: 0.00146
epssPercentile: 0.03386
---

## Overview

The WeddingCity Lite  WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.