CVE-2026-104730
CriticalCVSS 9.8Summary
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object, but with no known POP chain in the vulnerable software, it has no impact unless another plugin or theme with a POP chain is installed.
Risk Assessment
If a POP chain is present via another installed plugin or theme, an attacker could delete arbitrary files, retrieve sensitive data or execute code. The attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing an image in a non-viewable or private gallery.
Recommendation
Update the Sunshine Photo Cart plugin to a version later than 3.7.4, remove unused plugins/themes that may contain POP chains, and restrict public access to the favorites feature.
Other vulnerabilities in Sunshine Photo Cart
See all- CVE-2026-109689Medium
The Sunshine Photo Cart plugin for WordPress (up to version 3.7.4) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated or low-privileged user can access functionality that should be protected.
- CVE-2026-57703Medium
Sunshine Photo Cart plugin version 3.6.10.1 and earlier allows a subscriber to break access control. A subscriber can gain unauthorized privileges.
- CVE-2026-93617High
Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection. This issue affects Sunshine Photo Cart: from n/a through 3.7.1.
- CVE-2026-42776Medium
The Sunshine Photo Cart plugin up to version 3.6.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-39564Medium
The WordPress plugin Sunshine Photo Cart (sunshine-photo-cart) by sunshinephotocart has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions below 3.6.2.
- CVE-2025-68535Medium
Missing Authorization vulnerability in Sunshine Photo Cart (up to 3.5.7.1) allows exploiting incorrectly configured access control security levels.
- CVE-2025-62892Medium
The Sunshine Photo Cart plugin up to version 3.5.3 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.
Original NVD description (English source)
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS