CVE-2026-109689

Sunshine Photo Cart plugin version 3.6.10.1 and earlier allows a subscriber to break access control. A subscriber can gain unauthorized privileges.

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object, but with no known POP chain in the vulnerable software, it has no impact unless another plugin or theme with a POP chain is installed.

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection. This issue affects Sunshine Photo Cart: from n/a through 3.7.1.

The Sunshine Photo Cart plugin up to version 3.6.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The WordPress plugin Sunshine Photo Cart (sunshine-photo-cart) by sunshinephotocart has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions below 3.6.2.

Missing Authorization vulnerability in Sunshine Photo Cart (up to 3.5.7.1) allows exploiting incorrectly configured access control security levels.

The Sunshine Photo Cart plugin up to version 3.5.3 has a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. This enables unauthorized use of features.