CVE-2026-108069
UnknownSummary
The Sunshine Photo Cart WordPress plugin before version 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
Risk Assessment
An attacker can inject unwanted or malicious content into restricted galleries, compromising content integrity and user trust, and potentially enabling phishing or malware distribution.
Recommendation
Update the Sunshine Photo Cart plugin to version 3.7.4 or later, which includes the fix adding permission checks before accepting comments.
Other vulnerabilities in Sunshine Photo Cart WordPress plugin
See all- CVE-2026-85037Medium
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
- CVE-2026-16561High
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
Original NVD description (English source)
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS