# Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers <= 3.7.3 - Unauthenticated Missing Authorization to Image Comment Submission in Restricted Galleries

- **ID:** WPSEC-2026-0794
- **Plugin:** Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers (`sunshine-photo-cart`), https://wordpress.org/plugins/sunshine-photo-cart/
- **Affected versions:** from 3.0 before 3.7.4
- **Fixed in:** 3.7.4 (Update to 3.7.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sunshine-photo-cart
- **Fix released:** 2026-10-09
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0794/

## Description

The Sunshine Photo Cart plugin for WordPress is vulnerable to unauthorized comment submission via the sunshine_modal_add_comment AJAX action in versions 3.0 to 3.7.3, due to a missing gallery access check. The handler verified only a nonce and that the image's gallery allows comments. This makes it possible for unauthenticated attackers to post comments on images in galleries they do not have access to, such as password-protected, private, expired or login-only galleries, when those galleries have comments enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0794/
- https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.7.4/
- https://wordpress.org/plugins/sunshine-photo-cart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0794/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.