If you are using just a single VPN connection, you can import your wireguard configuration into NetworkManager and enable/disable directly from the toggle in the notification area negating any need for any .desktop files and having to enter your passphrase for sudo.
The VPN toggle operates on the last used VPN connection so if you are making use of multiple VPN connections it can get a little more involved but having all your VPN connections handled by NetworkManager makes for a cleaner and more integrated way of working than shortcuts and passing passphrases to sudo.