What is the CVSS score of EUVD-2026-48174?

EUVD-2026-48174 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Sunshine Photo Cart EUVD-2026-48174

| CVE-2026-57703 MEDIUM

Missing Authorization (CWE-862)

2026-07-23 Patchstack

GHSA-q6xv-m39h-j295

WordPress Authentication Bypass Sunshine Photo Cart Wordpress Plugin Sunshinephotocart

6.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

6.3 MEDIUM

Network-accessible missing authorization requiring subscriber authentication (PR:L); partial C/I/A impacts reflect unauthorized data access and modification within the plugin's scope without escalation to host system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:06 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

AnalysisAI

Broken access control in Sunshine Photo Cart WordPress plugin (versions <= 3.6.10.1) enables subscriber-level authenticated users to perform actions or access resources beyond their intended permissions. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to enforce proper authorization checks on certain endpoints accessible to low-privileged accounts. With partial confidentiality, integrity, and availability impact confirmed by the CVSS C:L/I:L/A:L metrics, affected photography business sites with open subscriber registration face meaningful risk of data exposure or unauthorized functional access. No public exploit has been identified at time of analysis.

Technical ContextAI

Sunshine Photo Cart is a WordPress e-commerce plugin tailored for photography businesses, identified by CPE cpe:2.3:a:sunshinephotocart:sunshine_photo_cart:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), a class of vulnerability in which the application executes sensitive operations without verifying whether the requesting user holds sufficient privileges. In WordPress, the 'subscriber' role is the lowest authenticated tier, typically limited to reading published content and managing their own profile. This plugin exposes functionality accessible to subscriber-level sessions that should be gated to higher roles such as editor or administrator, allowing subscribers to interact with protected plugin features. The CVSS vector AV:N/AC:L/PR:L/UI:N confirms the flaw is directly reachable over the network with no special configuration and only requires the attacker to hold a standard low-privilege account.

RemediationAI

Update the Sunshine Photo Cart plugin to the version identified as patched in the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-6-10-1-broken-access-control-vulnerability - an exact fixed version number was not independently confirmed from the input data and must be verified there directly. As an immediate compensating control, disable public subscriber self-registration on the WordPress site (Settings > General > uncheck 'Anyone can register') to eliminate the lowest-barrier exploitation path; note this may impact legitimate customer onboarding flows. Alternatively, temporarily deactivate the plugin until the patched version is confirmed and applied. Site administrators should also audit existing subscriber accounts for signs of unauthorized access to orders or photo delivery resources.