Weddingcity Lite
Monthly
Unauthenticated attackers can permanently delete arbitrary posts, pages, and media attachments on WordPress sites running WeddingCity Lite version 1.0.4 or earlier due to missing authorization checks in the plugin's deletion handler. The flaw, tracked as CWE-862, is remotely exploitable without authentication (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and affects default installations with the plugin active. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the risk is high for affected sites due to the trivial attack requirements, but exposure is limited by the plugin's niche install base.
Unauthenticated attackers can permanently delete arbitrary posts, pages, and media attachments on WordPress sites running WeddingCity Lite version 1.0.4 or earlier due to missing authorization checks in the plugin's deletion handler. The flaw, tracked as CWE-862, is remotely exploitable without authentication (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) and affects default installations with the plugin active. Publicly available exploit code exists, though no confirmed active exploitation (CISA KEV) has been reported; the risk is high for affected sites due to the trivial attack requirements, but exposure is limited by the plugin's niche install base.