CVE-2026-106029

UNKNOWN 0.0

WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

Vendor	unknown
Product	weddingcity lite
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for unknown weddingcity lite

Be the first to know when new unknown vulnerabilities affecting unknown weddingcity lite are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / WeddingCity Lite

0 ≤ 1.0.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/7a08e8fd-9795-4aac-b023-5e75b741400b/

Credits

Naoki Kawahigashi WPScan