CVE-2022-45826 MEDIUM

CVE-2022-45826: WordPress Sunshine Photo Cart plugin <= 2.9.13 - Auth. Broken Access Control vulnerability

Vendor Wp Sunshine
Product Sunshine Photo Cart
Weakness CWE-862 · Missing authorization
Published December 13, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 2.9.13.

Explanation of Vulnerability in Simple Terms

02Summary

Sunshine Photo Cart versions up to 2.9.13 lack proper authorization checks, allowing an unauthenticated attacker to modify or delete data by tricking a user into visiting a malicious link. The vulnerability requires user interaction but can compromise site integrity without authentication.

What an attacker can do

03Attacker Capabilities

Modify or delete site data by tricking a user into clicking a malicious link.

Potential impact on your site

04Site Impact

Unauthorized changes or deletion of photo cart data if users are socially engineered.

Conditions required to exploit

05Prerequisites

An unauthenticated attacker needs a site user to click a link they provide.

Key dates

06Disclosure timeline

December 13, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-1239 Ninja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint CVE-2026-57335 WordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability CVE-2026-11600 Envo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting CVE-2026-57327 WordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability CVE-2026-12119 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute