CVE-2026-108069

Deferred Deferred - Pending Action

Sunshine Photo Cart Comment Injection Vulnerability

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Sunshine Photo Cart WordPress plugin before 3.7.4 does not check whether a visitor is permitted to access a restricted gallery before accepting comment submissions for its images, while it does perform that check when displaying comments, allowing unauthenticated attackers to inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted (password-protected, email-gated, private, account-only or expired).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108069

EUVD

EUVD-2026-100850

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Sunshine	Photo Cart 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

The Sunshine Photo Cart WordPress plugin before version 3.7.4 has a flaw where it does not check if a visitor can access a restricted gallery before accepting comment submissions. This allows unauthenticated attackers to inject content with a chosen author name and email into restricted galleries like password-protected or private ones.

Detection Guidance

Check if your Sunshine Photo Cart plugin version is below 3.7.4 by inspecting the plugin files or WordPress admin panel. Look for unauthorized comments in restricted galleries with suspicious author names or emails.

Impact Analysis

Attackers could inject unwanted comments into restricted galleries, potentially defacing content or spreading misinformation. This could damage the reputation of the gallery owner or mislead visitors.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized content injection into restricted galleries. Attackers may insert malicious or inappropriate content with spoofed author details into private or protected galleries, which could lead to unauthorized data exposure or misuse of personal information. This undermines data integrity and access controls required by these regulations.

Mitigation Strategies

Update the Sunshine Photo Cart plugin to version 3.7.4 or later immediately to patch the vulnerability. Review and remove any unauthorized comments in restricted galleries.

Hi! I’m here to help you understand CVE-2026-108069. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70