7.5
High
CVE-2026-16561 The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX…
Description
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Sunshine Photo Cart 3.6 | earliest → < 3.6.12 | 3.6.12 |
Other CVEs of Sunshine Photo Cart
The 4 CVEs of Sunshine Photo Cart →
CVE-2026-108069
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a…
5.3
Medium
CVE-2026-85037
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs…
5.3
Medium
CVE-2022-4301
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it…
6.1
Medium