What is the CVSS score of CVE-2026-93617?

CVE-2026-93617 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Sunshine Photo Cart are affected by CVE-2026-93617?

Sunshine Photo Cart, a WordPress plugin, has a high-severity PHP object injection vulnerability in versions through 3.7.1 that is exploitable only by an authenticated high-privilege WordPress user.

How to fix or mitigate CVE-2026-93617?

Within 24 hours, inventory all WordPress sites running Sunshine Photo Cart versions through 3.7.1; deactivate or remove the plugin where business operations permit, and if it must remain, restrict access to its endpoints to trusted networks or roles, enforce least privilege and MFA for all high-privilege WordPress accounts, and review logs for suspicious serialized input. Within 7 days, apply any vendor-provided workaround if published, deploy WAF/virtual patching rules to detect and block PHP object injection payloads targeting Sunshine Photo Cart endpoints, audit privileged account activity, and consider temporarily disabling the plugin if it is not essential. Within 30 days, monitor the vendor advisory for a fixed version and, when released, test and deploy it; if no patch is available, evaluate replacing Sunshine Photo Cart with a maintained alternative or isolating the WordPress instance, and document compensating controls and residual risk.

Sunshine Photo Cart CVE-2026-93617

EUVD-2026-92749 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-10-05 Patchstack

GHSA-grvq-2w4w-4cx9

WordPress Deserialization Sunshine Photo Cart Wordpress Plugin

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable endpoint and no user interaction (AV:N/UI:N), but the operation requires an elevated authenticated account so PR:H; object injection can yield full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 05, 2026 - 20:05 vuln.today

CVE Published

Oct 05, 2026 - 19:00 cve.org

HIGH 7.2

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 15 High Severity Oct 06, 2026

AnalysisAI

PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions through 3.7.1) allows an attacker who already holds a high-privilege authenticated WordPress account to submit crafted serialized data to a plugin endpoint, potentially achieving object injection with high confidentiality, integrity and availability impact. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) rates this 7.2 and confirms the attacker must be authenticated with elevated privileges (PR:H), which excludes anonymous internet users and is the primary limiting factor; no user interaction is required. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated WordPress user with high privileges (CVSS PR:H) - i.e., the attacker must hold an administrative or equivalently elevated account before sending the malicious serialized data to the vulnerable Sunshine Photo Cart endpoint. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a PHP Object Injection (CWE-502) flaw in the Sunshine Photo Cart WordPress plugin, reported by Patchstack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch version is specified in the available intelligence at time of analysis, so the immediate action is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-7-1-php-object-injection-vulnerability?_s_id=cve) and the plugin's WordPress.org changelog for a release newer than 3.7.1 and upgrade to it as soon as it is published; if no fix is available, deactivate and remove the plugin if the photo cart functionality is not business-critical, accepting the loss of that feature. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress sites running Sunshine Photo Cart versions through 3.7.1; deactivate or remove the plugin where business operations permit, and if it must remain, restrict access to its endpoints to trusted networks or roles, enforce least privilege and MFA for all high-privilege WordPress accounts, and review logs for suspicious serialized input. …

Threat intelligence, references, and detailed analysis are available after sign-in.