CVE-2026-42776
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Sunshine Photo Cart plugin up to version 3.6.7 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
Unauthorized users can access administrative functions or data, potentially leading to security breaches.
Recommendation
Update the Sunshine Photo Cart plugin to the latest version and configure appropriate access permissions.
Other vulnerabilities in Sunshine Photo Cart
See all- CVE-2026-57703Medium
Sunshine Photo Cart plugin version 3.6.10.1 and earlier allows a subscriber to break access control. A subscriber can gain unauthorized privileges.
- CVE-2026-39564Medium
The WordPress plugin Sunshine Photo Cart (sunshine-photo-cart) by sunshinephotocart has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions below 3.6.2.
Original NVD description (English source)
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sunshine Photo Cart: from n/a through 3.6.7.