What the vulnerability does
01Description
The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.11. This is due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account.
Explanation of Vulnerability in Simple Terms
02Summary
Sunshine Photo Cart versions 3.4.11 and earlier contain a vulnerability allowing authenticated users with low privileges to read, modify, or delete data on the site. The vulnerability requires a valid user account but no special interaction. An attacker with basic user access can escalate their capabilities to affect site content and operations.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data including photos, proofs, and user information.
Potential impact on your site
04Site Impact
Photographers' galleries, client proofs, and user data can be compromised by any authenticated user.
Conditions required to exploit
05Prerequisites
Valid user account with low-level privileges; network access to the site.
Key dates
06Disclosure timeline
June 4, 2025
CVE published
April 8, 2026
Record updated
