CVE-2026-16561
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
Risk Assessment
The risk is the disclosure of private comments from restricted galleries, potentially violating user privacy and data confidentiality.
Recommendation
It is recommended to update the Sunshine Photo Cart plugin to version 3.6.12 or higher to enforce proper access controls.
Other vulnerabilities in Sunshine Photo Cart WordPress plugin
See all- CVE-2026-108069Unknown
The Sunshine Photo Cart WordPress plugin before version 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).
- CVE-2026-85037Medium
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
Original NVD description (English source)
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS