{"id":"CVE-2026-111842","kind":"vulnerability","aliases":["CVE-2026-111842"],"related":[],"title":"WordPress Sunshine Photo Cart: missing authorization check exposes restricted actions","description":"Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.","summary":"Sunshine Photo Cart, a WordPress plugin for selling photos, lacks an authorization check on some functionality, so users can reach actions they should not. The description does not say which actions or what data is exposed.","severity":"medium","cvss":5.3,"epss":0.00176,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","sunshine-photo-cart","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the Sunshine Photo Cart plugin (`sunshine-photo-cart`) in the WordPress admin plugins list or with `wp plugin get sunshine-photo-cart --field=version`\n- Confirm whether the plugin is active on the site","fix":"- Update Sunshine Photo Cart to a version later than `3.7.5` once the vendor publishes a fixed release (unknown if a fixed version is listed in the sources)","status":"open","published_at":"2026-10-22T09:17:13+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:28+00:00","updated_at":"2026-10-25T04:20:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:20:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update Sunshine Photo Cart to a version later than `3.7.5` once the vendor publishes a fixed release (unknown if a fixed version is listed in the sources)","reach":"internet","title":"WordPress Sunshine Photo Cart: missing authorization check exposes restricted actions","impact":"medium","summary":"Sunshine Photo Cart, a WordPress plugin for selling photos, lacks an authorization check on some functionality, so users can reach actions they should not. The description does not say which actions or what data is exposed.","category":"package","nicknames":[],"who_cares":["wordpress","sunshine-photo-cart"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unauthorized users reach restricted plugin actions; exact impact unknown","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-111842 for the affected functions, required privileges and fixed version.","how_to_check":"- Check the installed version of the Sunshine Photo Cart plugin (`sunshine-photo-cart`) in the WordPress admin plugins list or with `wp plugin get sunshine-photo-cart --field=version`\n- Confirm whether the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Sunshine Photo Cart version 3.7.5 or earlier are in scope. The sources do not say which roles or settings make a site exposed, so unknown. Sites without the plugin installed can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000628,"input_tokens":3365,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111842':13A,16A '-2026':12A,15A '3.7.5':88C 'access':76C 'action':10A,43B,53B 'affect':81C 'allow':72C 'author':6A,34B,60C 'cart':4A,21B,25B,67C,71C,84C 'check':7A,35B 'configur':75C 'control':77C 'cve':11A,14A 'data':56B 'descript':48B 'exploit':73C 'expos':8A,58B 'function':38B 'incorrect':74C 'issu':80C 'lack':32B 'levels.this':79C 'miss':5A,59C 'n/a':86C 'packag':17B 'photo':3A,20B,24B,31B,66C,70C,83C 'plugin':28B 'reach':42B 'restrict':9A 'say':51B 'secur':78C 'sell':30B 'sunshin':2A,19B,23B,64C,65C,69C,82C 'sunshine-photo-cart':18B,68C 'user':40B 'vulner':61C 'wordpress':1A,22B,27B 'wp':63C","nicknames":[],"mitigations":[],"who_affected":"Sites running Sunshine Photo Cart version 3.7.5 or earlier are in scope. The sources do not say which roles or settings make a site exposed, so unknown. Sites without the plugin installed can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T09:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111842","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111842","severity":null,"published_at":"2026-10-22T09:17:13+00:00","modified_at":"2026-10-22T15:15:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111842","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111842","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}