CVE-2026-16561 in Sunshine Photo Cart Plugin
Summary
by MITRE • 08/05/2026
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
The Sunshine Photo Cart WordPress plugin version 3.6.11 and earlier contains a critical access control vulnerability that undermines the security of user-generated content within WordPress environments. This flaw exists in the plugin's AJAX handling mechanism where proper authentication and authorization checks are absent, creating an avenue for unauthorized information disclosure. The vulnerability specifically affects galleries that are configured with private access restrictions, password protection, or other access control mechanisms that should normally prevent unauthorized viewing of image comments and associated metadata.
The technical implementation flaw stems from insufficient validation within the plugin's AJAX endpoint that processes comment retrieval requests. When users attempt to access comments associated with images in restricted galleries, the system fails to verify whether the requesting user possesses proper authorization rights to view those specific comments. This absence of access control validation operates at the application layer and represents a classic privilege escalation vulnerability that falls under CWE-284 - Improper Access Control. The flaw allows an attacker to bypass WordPress's built-in permission systems and directly query the plugin's AJAX handler to retrieve sensitive comment data from images that should remain inaccessible to unauthenticated users.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to harvest potentially sensitive metadata associated with image comments within restricted galleries. This includes user-generated content, timestamps, and potentially personal information that may have been shared in the context of private or password-protected gallery environments. The vulnerability affects any WordPress installation running an affected version of the Sunshine Photo Cart plugin, making it particularly dangerous given the widespread adoption of this plugin among WordPress users who rely on its gallery functionality for both public and private content sharing.
Organizations and individuals using affected versions of this plugin should immediately implement mitigations including updating to version 3.6.12 or later which contains the necessary access control fixes. Additionally, administrators should review their current gallery configurations and consider implementing additional security measures such as restricting access to AJAX endpoints through web application firewalls or implementing rate limiting mechanisms to detect unusual access patterns. The vulnerability demonstrates a common weakness in WordPress plugin development where developers may overlook proper input validation and authentication requirements for AJAX handlers, aligning with ATT&CK technique T1213.002 - Data from Information Repositories, which focuses on accessing stored data through application interfaces that lack proper access controls. System administrators should also monitor for potential exploitation attempts by reviewing access logs for unauthorized requests to the vulnerable plugin endpoints and consider implementing automated patch management processes to ensure timely remediation of similar vulnerabilities across their WordPress installations.