CVE-2026-85037: Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user can exploit it; no account or prior authorization is required.
What does an attacker need to manipulate an order price?
The attacker needs access to a lower price identifier defined elsewhere on the same site and can supply that identifier when adding a different item to the cart.
What is the business impact of successful exploitation?
An attacker can purchase items at a lower price than intended and complete the order at that price, causing financial loss to the site owner.
Which plugin versions are affected?
Sunshine Photo Cart versions before 3.7 are affected.