Vulnerabilities / Sunshine Photo Cart / WPSEC-2026-1474
Sunshine Photo Cart <= 3.7.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Deletion
Medium 6.5
CWE-639Fixed in 3.8
- ID
- WPSEC-2026-1474
- Plugin
- Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers (sunshine-photo-cart)
- Affected
- all versions before 3.8
- Remediation
- Update to 3.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Sunshine Photo Cart on WPSec AttackSurface
- Fix released
- Published
Description
The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the Stripe hosted checkout and PayPal (Legacy) cancel handlers in all versions up to, and including, 3.7.5, due to the cancel nonce using one action for every order (and so being the same for all logged-out visitors) and the handlers not checking that the supplied order belongs to the visitor's checkout session or is still unpaid. This makes it possible for unauthenticated attackers to permanently delete arbitrary orders, including paid ones.
References
- https://wpsec.com/vuln/WPSEC-2026-1474/
- https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/
- https://wordpress.org/plugins/sunshine-photo-cart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS