Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-106029— WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion

Quick assessment

Affected
Unknown WeddingCity Lite
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 WeddingCity Lite WordPress 插件 1.0.4 及更早版本中，删除文章、页面和媒体附件之前未进行任何身份验证或有效性检查，这使得未授权的攻击者能够永久性地删除网站范围内的任意内容。

AI Predicted 9.8 Difficulty: Easy EPSS 0.25% · P16

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown WeddingCity Lite ≤ 1.0.4 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-106029

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
WeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion
Source: CVE Program / CVE List V5
Vulnerability Description
The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown WeddingCity Lite 0 ~ 1.0.4 -

II. Public POCs for CVE-2026-106029

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-106029

请登录查看更多情报信息。

Same Patch Batch · Unknown · 2026-10-11 · 63 CVEs total

CVE-2026-88785 Simple Membership < 4.8.3 - Newly Registered Member Password Disclosure via URL Query Stri
CVE-2026-89304 Paymendo Bank Transfer <= 1.1 - Unauthenticated Blind SQLi via 'paymendo_bank_transfer_com
CVE-2026-93550 Veeqo for WooCommerce <= 2.2.8 - Subscriber+ Arbitrary File Upload via start_veeqo_connect
CVE-2026-89305 Paymendo Bank Transfer <= 1.1 - Subscriber+ SQLi via 'orderBy' Parameter
CVE-2026-89302 Post Voting System <= 1.0 - Unauthenticated SQLi via 'id' Parameter
CVE-2026-89195 Site Setup Wizard <= 1.5.8 - Unauthenticated SQLi via ssw_check_admin_email_exists
CVE-2026-89214 WpCues Basic Quiz <= 1.6.5 - Unauthenticated SQLi via Quiz Result Submission
CVE-2026-89213 Llavero.io <= 0.1.4 - Unauthenticated Blind SQLi via 'cill_login' Parameter
CVE-2026-88905 KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSet
CVE-2026-88903 Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook
CVE-2026-89232 RecordBrowser <= 1.1.7 - Unauthenticated SQLi via 'recordid' Parameter
CVE-2026-88826 SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
CVE-2026-88827 Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Applicatio
CVE-2026-87764 BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
CVE-2026-86798 HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
CVE-2026-86706 Quick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update
CVE-2026-86717 Insurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup
CVE-2026-87762 Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Ju
CVE-2026-87760 Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
CVE-2026-87761 Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings

Showing top 20 of 63 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same vendor: Unknown

V. Comments for CVE-2026-106029

No comments yet

Leave a comment