Sunshine Photo Cart EUVD-2026-100850

Exploitation requires that the target site runs Sunshine Photo Cart before 3.7.4 AND has at least one gallery configured as restricted - password-protected, email-gated, private, account-only, or expired - since the flaw is the failure to enforce that same restriction on the comment-submission path. No authentication, credentials, user interaction, or knowledge of the gallery password is needed (PR:N/UI:N), so any default restricted gallery is reachable remotely. Limiting factors: the site must actually use the gallery-restriction feature (public galleries are not the target of this bypass), impact is confined to injecting comment content/metadata (integrity only, no data disclosure or availability loss), and injected comments are subject to whatever moderation the site enforces on display.

This is a genuine but modest-severity integrity flaw, not a critical priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction, which aligns with the description of missing authorization on comment submission. However, impact is limited to integrity only (C:N/I:L/A:N), capping the base score at 5.3 (Medium). Multiple signals agree it is low urgency: EPSS is only 0.13% (2nd percentile), it is NOT on CISA KEV, and the SSVC decision framework reports Exploitation: none. The one amplifying signal is SSVC Automatable: yes, consistent with AC:L/PR:N - the injection could be scripted at scale. Publicly available exploit code (WPScan) lowers the barrier, but POC availability is distinct from active exploitation and nothing here indicates in-the-wild use. Net: a real, easily reproducible content-injection/spoofing issue worth patching on a normal cycle, not an emergency. No major conflicts between sources; the chief caveat is that the vendor/product metadata is marked 'unknown' in the CPE.

An unauthenticated attacker identifies a WordPress site running Sunshine Photo Cart with a password-protected, private, or account-only gallery and sends a crafted comment-submission request directly to the image endpoint, bypassing the access gate that is only enforced on display. The attacker supplies a chosen author name, email, and body, injecting spoofed or malicious comment content into galleries they were never permitted to view. Publicly available exploit code from WPScan makes this trivially reproducible and scriptable across many sites.