Sunshine Photo Cart CVE-2026-109689

Exploitation requires only that a WordPress site running Sunshine Photo Cart version n/a through 3.7.4 be network-reachable; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are needed against default installations. The practical limiting factor is impact scope rather than access: the flaw yields only partial confidentiality disclosure (C:L) with no integrity or availability effect, so the realistic risk is unauthorized read access to plugin-managed data (e.g., cart or gallery/customer information) rather than site compromise. The exact restricted feature or endpoint affected is not specified in the description - verify against the Patchstack advisory to determine which data is exposed.

This is a medium-severity (CVSS 5.3) Missing Authorization flaw (CWE-862) in the Sunshine Photo Cart WordPress plugin, reported by Patchstack. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates network-reachable, low-complexity exploitation requiring no privileges (PR:N) and no user interaction, with a limited confidentiality impact only (C:L) and no integrity or availability impact (I:N/A:N) - consistent with a broken access control issue that exposes data that should be restricted rather than enabling takeover. No EPSS score, KEV listing, or POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The real-world priority is moderate-to-low: the unauthenticated network vector and low complexity make it easy to trigger, but the impact is capped at partial information disclosure with no write or denial-of-service capability. SSVC-style framing: exploitation is 'none' observed, technical impact is 'partial', and automatability is plausible given AV:N/AC:L/PR:N, but the limited C:L impact keeps this out of urgent-patch territory absent new exploitation signals. Treat as a routine-priority patch unless the exposed data is sensitive in your deployment.

A remote, unauthenticated attacker sends a crafted request directly to a Sunshine Photo Cart plugin endpoint that fails to verify the caller's authorization, retrieving photo cart or customer data that should be access-restricted. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability to the WordPress site and no login or victim interaction. No public proof-of-concept was identified in the provided data.