7.5
Élevée
CVE-2026-16561 The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX…
Description
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Sunshine Photo Cart 3.6 | premières → < 3.6.12 | 3.6.12 |
Autres CVE de Sunshine Photo Cart
Les 4 CVE de Sunshine Photo Cart →
CVE-2026-108069
The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a…
5.3
Moyenne
CVE-2026-85037
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs…
5.3
Moyenne
CVE-2022-4301
The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it…
6.1
Moyenne