Sunshine Photo Cart Client Photo Gallery Photo Proofing For Photographers
Monthly
Unauthenticated PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions up to and including 3.7.4) allows an attacker to store a crafted serialized payload through the plugin's public favorites page, which is then deserialized when any image in a non-viewable or private gallery is viewed. The plugin ships no usable POP gadget chain of its own, so the flaw has no impact on a site running only this plugin; impact materialises only when a separate plugin or theme on the same installation provides a chain, in which case the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and while the submitted CVSS is 9.8 the mandatory external gadget-chain precondition means our independent assessment rates it AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact when the precondition is met.
Unauthenticated PHP object injection in the WordPress plugin Sunshine Photo Cart (all versions up to and including 3.7.4) allows an attacker to store a crafted serialized payload through the plugin's public favorites page, which is then deserialized when any image in a non-viewable or private gallery is viewed. The plugin ships no usable POP gadget chain of its own, so the flaw has no impact on a site running only this plugin; impact materialises only when a separate plugin or theme on the same installation provides a chain, in which case the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit code or confirmed active exploitation was identified at time of analysis, and while the submitted CVSS is 9.8 the mandatory external gadget-chain precondition means our independent assessment rates it AV:N/AC:H/PR:N/UI:N with high confidentiality, integrity, and availability impact when the precondition is met.