CVE-2025-62892
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Sunshine Photo Cart plugin up to version 3.5.3 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.
Risk Assessment
The organization may face unauthorized access to plugin functionality, potentially leading to data breaches or unauthorized actions.
Recommendation
Update the plugin to the latest version and verify ACL settings.
Other vulnerabilities in Sunshine Photo Cart
See all- CVE-2026-57703Medium
Sunshine Photo Cart plugin version 3.6.10.1 and earlier allows a subscriber to break access control. A subscriber can gain unauthorized privileges.
- CVE-2026-93617High
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection. This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
- CVE-2026-42776Medium
The Sunshine Photo Cart plugin up to version 3.6.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-39564Medium
The WordPress plugin Sunshine Photo Cart (sunshine-photo-cart) by sunshinephotocart has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions below 3.6.2.
- CVE-2025-68535Medium
Missing Authorization vulnerability in Sunshine Photo Cart (up to 3.5.7.1) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS