Live › vulnerability › CVE-2026-111842
Go to dashboardSunshine Photo Cart, a WordPress plugin for selling photos, lacks an authorization check on some functionality, so users can reach actions they should not. The description does not say which actions or what data is exposed.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Sunshine Photo Cart version 3.7.5 or earlier are in scope. The sources do not say which roles or settings make a site exposed, so unknown. Sites without the plugin installed can skip it.
No product ranges from the sources yet.
sunshine-photo-cart) in the WordPress admin plugins list or with wp plugin get sunshine-photo-cart --field=version3.7.5 once the vendor publishes a fixed release (unknown if a fixed version is listed in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-111842")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.