EUVD-2025-16851
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account.
Analysis
The Sunshine Photo Cart plugin for WordPress (versions ≤3.4.11) contains an improper key validation vulnerability in its password reset functionality, allowing authenticated attackers with Subscriber-level privileges to perform privilege escalation by resetting arbitrary user passwords, including administrators. With a CVSS score of 8.8 and a low attack complexity (network-accessible, no user interaction required), this vulnerability poses a critical threat to WordPress installations using this plugin. The vulnerability is likely to be actively exploited given the straightforward attack path and the high-value target (admin account takeover).
Technical Context
The vulnerability exists in the Sunshine Photo Cart plugin's password reset mechanism, which fails to properly validate user-supplied authentication keys (CWE-620: Improper Validation of Array Index). The root cause is insufficient validation of the password reset token or key parameter, allowing attackers to bypass the intended authorization checks. WordPress plugins typically implement password resets via nonce-protected forms and temporary tokens; this plugin appears to accept user-controlled keys without proper cryptographic verification or rate-limiting. The affected product is identified as the Sunshine Photo Cart free WordPress plugin, affecting all versions up to and including 3.4.11. The vulnerability is accessible to any authenticated user at the Subscriber role or above, meaning compromised low-privilege accounts or those created by attackers can be leveraged for lateral privilege escalation to administrative accounts.
Affected Products
Product: Sunshine Photo Cart (Free Client Photo Galleries for Photographers) - WordPress Plugin. Affected Versions: All versions up to and including 3.4.11. Unaffected Versions: 3.4.12 and later (assumed based on standard vulnerability disclosure practices; verify with vendor). Configuration: Affects all WordPress installations with the plugin active, regardless of additional security plugins or configurations. The vulnerability requires only that the attacker possess valid WordPress credentials at Subscriber level or above (Contributor, Author, Editor, Administrator roles also affected). WordPress multisite installations may be partially affected depending on role mapping and cross-site capabilities.
Remediation
Immediate Actions: (1) Update the Sunshine Photo Cart plugin to version 3.4.12 or later immediately upon release. (2) If immediate patching is not possible, deactivate and remove the plugin until a patch is available. (3) Audit all user accounts for unauthorized password changes in the past 30-90 days, particularly administrator accounts. (4) Review WordPress access logs for suspicious password reset requests. (5) Force password resets for all administrative accounts. Temporary Mitigations: (1) Remove Subscriber-level user accounts or restrict their capabilities if unused. (2) Implement Web Application Firewall (WAF) rules to block requests to password reset endpoints with malformed or repeated key parameters. (3) Enable two-factor authentication (2FA) on all administrative accounts to limit account takeover impact. (4) Monitor for suspicious password reset attempts in WordPress logs. (5) Restrict plugin functionality to specific user roles if the plugin supports role-based access controls. Long-term: Monitor the plugin developer's security advisories for patch release dates and implement automated update mechanisms for WordPress plugins.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today