CVE-2026-108069: Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sunshine Photo Cartto a version that resolves this vulnerability.Fixed in 3.7.4
Event History
Frequently Asked Questions
Which galleries are affected?
Restricted galleries are affected, including password-protected, email-gated, private, account-only, and expired galleries. The issue occurs because comment submission does not enforce the gallery access check.
Does an attacker need an account or access to the restricted gallery?
No. The issue can be exploited by an unauthenticated attacker because comment submissions are accepted without verifying that the visitor is permitted to access the gallery.
What can an attacker inject?
An attacker can submit attacker-chosen comment content and choose the author name and email associated with the comment. The comment may not be displayed to unauthorized visitors because display-time access checks are performed.
What version fixes the issue?
Upgrade Sunshine Photo Cart to version 3.7.4 or later. Versions before 3.7.4 are affected.