CVE-2026-16561highCWE-862

CVE-2026-16561: high-severity vulnerability in Sunshine Photo Cart

Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure

Published

Follow this CVE+ Monitor Sunshine Photo Cart

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 7.5epss 0.4%
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Unknown · Sunshine Photo Cart
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Sunshine Photo Cart

In the same product, most dangerous first.

CVE-2022-4301MEDIUMSunshine Photo Cart < 2.9.15 - Reflected XSSEPSS 0.9%CVE-2026-85037MEDIUMSunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOREPSS 0.3%CVE-2026-108069MEDIUMSunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()EPSS 0.2%