WordPress Plugin Allows Unauthenticated Content Deletion

The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments, allowing unauthenticated attackers to permanently delete arbitrary content site-wide.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WeddingCity Lite WordPress plugin through version 1.0.4 contains a critical authorization bypass vulnerability that permits unauthenticated attackers to permanently delete arbitrary posts, pages, and media attachments. This vulnerability stems from missing authorization and validity checks in the plugin's deletion functions (CWE-862: Missing Authorization). Any WordPress site running this plugin is exposed to complete content destruction without requiring valid credentials, making this a severe threat to site availability and integrity. Small businesses, event planners, and organizations relying on WordPress for their web presence are directly impacted, as attackers can systematically wipe out years of published content, damage reputation, and disrupt operations.

Casky's 283 matching security skills leverage Claude AI's extended reasoning to detect the attack patterns underlying this vulnerability across two MITRE ATT&CK tactics: TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe detection patterns for unauthorized API calls to deletion endpoints without proper authentication tokens, unusual bulk delete requests originating from external sources, and failed authentication attempts followed by successful deletions—indicating authorization bypass exploitation. The platform would flag suspicious HTTP requests to wp-admin AJAX handlers and REST API endpoints that handle post/attachment deletion, combined with behavioral analysis showing unauthenticated sessions performing administrative actions. These skills enable security teams to identify exploitation attempts in real-time and correlate them with known attack signatures before content loss occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-106029.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-106029

Casky has 283 skills that investigate the attack patterns behind CVE-2026-106029. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn