CVE-2026-109689: WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/sunshine-photo-cartto a version that resolves this vulnerability.Fixed in 3.7.5
Event History
Frequently Asked Questions
Which installations are affected?
Sunshine Photo Cart versions through 3.7.4 are affected. The available data does not identify a lower fixed version or any unaffected configuration.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the expected impact?
The reported impact is limited to confidentiality, with no integrity or availability impact indicated in the CVSS vector.