---
id: "CVE-2026-111842"
kind: "vulnerability"
aliases: ["CVE-2026-111842"]
title: "WordPress Sunshine Photo Cart: missing authorization check exposes restricted actions"
severity: "medium"
cvss: 5.3
epss: 0.00176
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "sunshine-photo-cart", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-22T09:17:13+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T04:20:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111842", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111842", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# WordPress Sunshine Photo Cart: missing authorization check exposes restricted actions

Sunshine Photo Cart, a WordPress plugin for selling photos, lacks an authorization check on some functionality, so users can reach actions they should not. The description does not say which actions or what data is exposed.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Sunshine Photo Cart plugin (`sunshine-photo-cart`) in the WordPress admin plugins list or with `wp plugin get sunshine-photo-cart --field=version`
- Confirm whether the plugin is active on the site

## Fix

- Update Sunshine Photo Cart to a version later than `3.7.5` once the vendor publishes a fixed release (unknown if a fixed version is listed in the sources)

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111842
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111842

## From the sources

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_