What is the CVSS score of EUVD-2025-16851?

EUVD-2025-16851 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by EUVD-2025-16851?

A high-severity vulnerability in the Sunshine Photo Cart WordPress plugin allows attackers with basic user access to take over administrator accounts by resetting passwords without proper…. A patch is available.

How to fix or mitigate EUVD-2025-16851?

Within 24 hours: Identify all WordPress installations running Sunshine Photo Cart and verify plugin version; disable the plugin immediately if version 3.4.11 or earlier is detected. Within 7 days: Apply the available patch to all affected installations and re-enable the plugin after validation testing. Within 30 days: Conduct a security audit of admin account activity logs from the past 90 days to detect any unauthorized password changes or suspicious access; reset all administrative credentials as a precautionary measure.

PHP EUVD-2025-16851

| CVE-2025-5482 HIGH

Unverified Password Change (CWE-620)

2025-06-04 security@wordfence.com

WordPress Privilege Escalation PHP Sunshine Photo Cart

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16851

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

Patch released

Mar 14, 2026 - 17:29 nvd

Patch available

CVE Published

Jun 04, 2025 - 08:15 nvd

HIGH 8.8

DescriptionCVE.org

The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account.

AnalysisAI

The Sunshine Photo Cart plugin for WordPress (versions ≤3.4.11) contains an improper key validation vulnerability in its password reset functionality, allowing authenticated attackers with Subscriber-level privileges to perform privilege escalation by resetting arbitrary user passwords, including administrators. With a CVSS score of 8.8 and a low attack complexity (network-accessible, no user interaction required), this vulnerability poses a critical threat to WordPress installations using this plugin. The vulnerability is likely to be actively exploited given the straightforward attack path and the high-value target (admin account takeover).

Technical ContextAI

The vulnerability exists in the Sunshine Photo Cart plugin's password reset mechanism, which fails to properly validate user-supplied authentication keys (CWE-620: Improper Validation of Array Index). The root cause is insufficient validation of the password reset token or key parameter, allowing attackers to bypass the intended authorization checks. WordPress plugins typically implement password resets via nonce-protected forms and temporary tokens; this plugin appears to accept user-controlled keys without proper cryptographic verification or rate-limiting. The affected product is identified as the Sunshine Photo Cart free WordPress plugin, affecting all versions up to and including 3.4.11. The vulnerability is accessible to any authenticated user at the Subscriber role or above, meaning compromised low-privilege accounts or those created by attackers can be leveraged for lateral privilege escalation to administrative accounts.

RemediationAI

Immediate Actions: (1) Update the Sunshine Photo Cart plugin to version 3.4.12 or later immediately upon release. (2) If immediate patching is not possible, deactivate and remove the plugin until a patch is available. (3) Audit all user accounts for unauthorized password changes in the past 30-90 days, particularly administrator accounts. (4) Review WordPress access logs for suspicious password reset requests. (5) Force password resets for all administrative accounts. Temporary Mitigations: (1) Remove Subscriber-level user accounts or restrict their capabilities if unused. (2) Implement Web Application Firewall (WAF) rules to block requests to password reset endpoints with malformed or repeated key parameters. (3) Enable two-factor authentication (2FA) on all administrative accounts to limit account takeover impact. (4) Monitor for suspicious password reset attempts in WordPress logs. (5) Restrict plugin functionality to specific user roles if the plugin supports role-based access controls. Long-term: Monitor the plugin developer's security advisories for patch release dates and implement automated update mechanisms for WordPress plugins.