Sunshine Photo Cart CVE-2026-104730

Exploitation requires that a SEPARATE plugin or theme on the same WordPress site provide a usable PHP POP (property-oriented programming) gadget chain - the Sunshine Photo Cart plugin contains none, so with only this plugin installed the vulnerability has zero impact. When a gadget chain is present, no authentication is needed: the attacker stores the serialized payload via the plugin's public favorites page, and deserialization is triggered when any image in a non-viewable or private gallery is viewed. The primary limiting factor is the mandatory presence of an external POP chain (an environmental precondition outside the attacker's control); affected versions are all releases up to and including 3.7.4.

The input assigns CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), which on its face signals a top-priority, remotely exploitable, unauthenticated flaw. However, the description introduces a decisive caveat that the raw score does not capture: no POP (property-oriented programming) gadget chain exists in the vulnerable plugin itself, so the PHP Object Injection has NO impact in isolation. Real-world severity is therefore conditional on a SECOND plugin or theme on the same site supplying a usable POP chain. This is a meaningful signal conflict - the 9.8 assumes full C/I/A compromise, but that outcome is contingent on an environmental precondition outside the attacker's control, so the effective risk for any given site is substantially lower than 9.8 and highly variable. No EPSS score is provided; there is no CISA KEV listing and no public exploit was identified in the input, so there is no evidence of active exploitation or weaponization at this time. The vulnerability is credible and the injection vector (unauthenticated store via the public favorites page, triggered by viewing a private-gallery image) is genuinely low-friction, so sites running this plugin alongside gadget-bearing plugins/themes should patch promptly; sites running it in isolation face no direct impact from this issue alone. Treat as a high-potential, environment-dependent risk rather than a confirmed universal critical.

An unauthenticated attacker submits a crafted serialized payload through the plugin's public favorites page, storing a malicious PHP object in the session. When the payload is later deserialized - triggered simply by viewing any image in a non-viewable or private gallery - a PHP object is instantiated; if a separate installed plugin or theme provides a POP gadget chain, this can escalate to arbitrary file deletion, sensitive data disclosure, or remote code execution. No public exploit code was identified in the provided data, and impact is null on sites lacking an external POP chain.