The WeddingCity Lite WordPress plugin up through version 1.0.4 fails to perform any authorization or validity checks before executing deletion of posts, pages and media files. An attacker who is not logged in can issue a deletion request and permanently remove arbitrary content site‑wide, erasing data, breaking site structure and potentially causing a loss of revenue or trust. This flaw is a direct lack of access control, classifying it as an improper authorization weakness.

WordPress sites that have the WeddingCity Lite plugin installed with a version of 1.0.4 or earlier are affected. The vulnerability can be triggered through any publicly accessible URL that invokes the plugin’s delete functionality.

The CVSS score of 7.5 indicates a high severity for this flaw, and the EPSS score of < 1% indicates a low probability of exploitation. Because the plugin omits any authorization or validity checks before deleting content, the vulnerability could be exploited by an unauthenticated attacker. Based on the description, it is inferred that the attack vector is an unauthenticated HTTP request to the plugin’s deletion endpoint; the attacker does not need credentials or special conditions to exploit the flaw. It is not listed in the CISA KEV catalog as of this analysis.