What is the CVSS score of CVE-2026-16561?

CVE-2026-16561 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Sunshine Photo Cart are affected by CVE-2026-16561?

Sunshine Photo Cart plugin exposes private gallery comments to unauthorized external users, allowing any internet user to bypass intended access restrictions.. A patch is available.

Is there a public PoC exploit available for CVE-2026-16561?

Yes, a public proof-of-concept exploit is available for CVE-2026-16561. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-16561?

Within 24 hours, identify all WordPress instances running Sunshine Photo Cart and catalog those with password-protected or restricted access galleries. Within 7 days, develop a patching schedule and communicate with content owners regarding the maintenance window required for Sunshine Photo Cart version 3.6.12 deployment. Within 30 days, complete migration to version 3.6.12 across all affected installations to eliminate the authorization bypass.

Sunshine Photo Cart CVE-2026-16561

EUVD-2026-53100 HIGH

Missing Authorization (CWE-862)

2026-08-05 WPScan

GHSA-757h-48w7-3vc3

WordPress Authentication Bypass Sunshine Photo Cart Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Only image comments are disclosed, not full gallery content or credentials, warranting C:L over C:H; AV:N and PR:N confirmed by unauthenticated AJAX exploitation path.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 16:50 vuln.today

Patch available

Aug 05, 2026 - 07:01 EUVD

CVE Published

Aug 05, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 05, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.

AnalysisAI

Unauthenticated information disclosure in the Sunshine Photo Cart WordPress plugin (all versions before 3.6.12) allows any internet-connected user to retrieve image comments from private, password-protected, or otherwise access-restricted galleries by exploiting a missing authorization check on an AJAX endpoint. The flaw is classified as CWE-862 (Missing Authorization) and carries a CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N). A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (4th percentile) and no CISA KEV listing indicate no confirmed widespread exploitation at time of analysis.

Technical ContextAI

Sunshine Photo Cart is a WordPress plugin providing photo gallery and e-commerce cart functionality. WordPress plugins commonly register AJAX handlers via wp_ajax_nopriv_* hooks, which are reachable by unauthenticated users through wp-admin/admin-ajax.php. The root cause is CWE-862 (Missing Authorization): at least one AJAX action in this plugin fails to verify whether the requesting user holds sufficient permissions to access gallery content before returning image comments. Because the check is entirely absent rather than merely flawed, the gallery's privacy classification - private, password-protected, or otherwise restricted - is irrelevant to the server's response. The CPE cpe:2.3:a:unknown:sunshine_photo_cart:*:*:*:*:*:*:*:* covers all versions up to but not including 3.6.12; the vendor field is listed as 'unknown' by NVD, indicating incomplete attribution in the national database - version range is corroborated by EUVD data (EUVD-2026-53100).

RemediationAI

Update the Sunshine Photo Cart WordPress plugin to version 3.6.12 or later, which contains the access control fix for the affected AJAX action; this patch is available from the vendor and through the WordPress plugin repository. The WPScan advisory at https://wpscan.com/vulnerability/25bbf054-3b3f-4d88-899e-03d48055cbcd/ provides additional patch context. If immediate patching is not possible, a WAF rule blocking POST requests to wp-admin/admin-ajax.php for the specific vulnerable action parameter will eliminate the attack surface, though the exact action name should be confirmed from the WPScan advisory before deploying this control to avoid disrupting legitimate plugin functionality. Deactivating the plugin entirely until patching is feasible removes all exposure at the cost of photo cart functionality. No workaround should be considered permanent - applying the 3.6.12 patch is the only confirmed fix.