Medium · 6.3 CVE-2026-42776 EUVD-2026-31750GHSA-42vq-h95x-4x26

WordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability

Published May 25, 2026 · Updated May 26, 2026 · Assigned by Patchstack

Description

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Sunshine Photo Cart: from n/a through 3.6.7.

Vendor	Product	Affected	Fixed
WP Sunshine	Sunshine Photo Cart	≤ 3.6.7	—