5.3
Medium
CVE-2026-85037 The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs…
Description
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Sunshine Photo Cart 3.7 | earliest → < 3.7 | 3.7 |
Other CVEs of Sunshine Photo Cart
The 4 CVEs of Sunshine Photo Cart →
CVE-2026-108069
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a…
5.3
Medium
CVE-2026-16561
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX…
7.5
High
CVE-2022-4301
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it…
6.1
Medium