WeddingCity Lite CVE-2026-106029

No special conditions - remote unauthenticated exploitation against default installations of the WeddingCity Lite WordPress plugin version 1.0.4 and earlier; the deletion handler performs no authorization or validity check, so no account, token, or user interaction is required. The only prerequisite is that a target site has the vulnerable plugin installed and active and that the vulnerable endpoint is network-reachable. The sole limiting factor is deployment scope: the plugin is a niche wedding-site add-on with a small install base, so exposure is narrow despite the trivial attack requirements.

This is a genuinely high-priority issue for affected sites, not a high-CVSS-but-low-impact case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction - the easiest possible access profile - and the CWE-862 (Missing Authorization) root cause means the flaw is a direct missing access-control check rather than a complex memory-corruption primitive. Public exploit code exists (WPScan), which raises near-term exploitability, though this is distinct from confirmed active exploitation. There is NO CISA KEV listing and NO EPSS score provided in the input, so widespread, automated exploitation cannot be asserted from the data; the realistic risk is bounded by the product's small deployment footprint rather than by exploitation difficulty. The scored impact is Integrity-only (I:H, with C:N and A:N), reflecting unauthorized destruction of content; note that permanent site-wide deletion of posts, pages, and media is arguably also an availability impact, so the single-dimension I:H score may understate operational disruption - worth verifying against the WPScan advisory.

An unauthenticated attacker locates a WordPress site running WeddingCity Lite ≤1.0.4 and sends crafted HTTP requests to the vulnerable deletion endpoint, which performs no authorization or validity check. By iterating over post, page, and attachment identifiers, the attacker permanently wipes arbitrary site content. Public exploit code from WPScan lowers the skill barrier and makes opportunistic, scripted abuse feasible.