CVE-2026-24994
Missing Authorization in Sunshine Photo Cart Allows Unauthorized Access
Publication date: 2026-02-03
Last updated on: 2026-02-03
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sunshinephotocart | sunshine_photo_cart | to 3.5.7.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24994 is a Broken Access Control vulnerability found in the WordPress Sunshine Photo Cart Plugin versions up to and including 3.5.7.2. It occurs due to missing authorization, authentication, or nonce token checks within certain functions of the plugin.
This flaw potentially allows unauthenticated users to perform actions that should be restricted to higher-privileged users, meaning attackers can bypass normal access controls.
The vulnerability is categorized under the OWASP Top 10 as A1: Broken Access Control and has a CVSS score of 5.3, indicating a low severity impact.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to perform privileged actions within the Sunshine Photo Cart plugin, potentially leading to unauthorized changes or access to sensitive functions.
Although the CVSS score is 5.3, indicating low severity, exploitation could still result in unauthorized control over certain plugin features, which might affect the integrity or availability of the affected system.
Users of the plugin are advised to update to version 3.5.7.3 or later to mitigate this risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability arises from missing authorization, authentication, or nonce token checks within certain functions of the Sunshine Photo Cart plugin up to version 3.5.7.2.'}, {'type': 'paragraph', 'content': 'Detection can involve checking the version of the Sunshine Photo Cart plugin installed on your WordPress system to see if it is version 3.5.7.2 or earlier.'}, {'type': 'paragraph', 'content': "Since the vulnerability requires no prior authentication to be exploited, monitoring for unusual or unauthorized actions performed by unauthenticated users on the plugin's endpoints may help detect exploitation attempts."}, {'type': 'paragraph', 'content': 'Specific commands are not provided in the available resources, but you can check the plugin version via command line by running commands such as:'}, {'type': 'list_item', 'content': 'wp plugin list | grep sunshine-photo-cart'}, {'type': 'list_item', 'content': "grep -r 'Version' wp-content/plugins/sunshine-photo-cart/"}, {'type': 'paragraph', 'content': 'Additionally, reviewing web server logs for suspicious requests targeting the Sunshine Photo Cart plugin endpoints without proper authentication may help identify exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary immediate step to mitigate this vulnerability is to update the Sunshine Photo Cart plugin to version 3.5.7.3 or later, where the issue is resolved.'}, {'type': 'paragraph', 'content': "If updating immediately is not possible, consider restricting access to the plugin's endpoints by implementing additional access controls or firewall rules to prevent unauthenticated users from exploiting the missing authorization."}, {'type': 'paragraph', 'content': 'Using automated update tools such as those offered by Patchstack can facilitate rapid mitigation by ensuring the plugin is updated promptly.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability is a Broken Access Control issue that allows unauthenticated users to perform actions reserved for higher-privileged users. Such unauthorized access could potentially lead to unauthorized data exposure or modification.
While the CVE description and resources do not explicitly mention compliance with standards like GDPR or HIPAA, broken access control vulnerabilities generally pose risks to data confidentiality and integrity, which are critical aspects of these regulations.
Therefore, if exploited, this vulnerability could negatively impact compliance with regulations that require strict access controls and protection of sensitive data.