CVE-2026-39564
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WordPress plugin Sunshine Photo Cart (sunshine-photo-cart) by sunshinephotocart has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions below 3.6.2.
Risk Assessment
An attacker may intercept sensitive data transmitted by the plugin, potentially leading to information disclosure or further security breaches.
Recommendation
Update the Sunshine Photo Cart plugin to version 3.6.2 or later, which includes a fix.
Other vulnerabilities in Sunshine Photo Cart
See all- CVE-2026-57703Medium
Sunshine Photo Cart plugin version 3.6.10.1 and earlier allows a subscriber to break access control. A subscriber can gain unauthorized privileges.
- CVE-2026-42776Medium
The Sunshine Photo Cart plugin up to version 3.6.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Retrieve Embedded Sensitive Data.This issue affects Sunshine Photo Cart: from n/a through < 3.6.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS