{
 "id": "WPSEC-2026-1474",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1474/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1474/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1474/index.md",
 "title": "Sunshine Photo Cart <= 3.7.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Deletion",
 "description": "The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the Stripe hosted checkout and PayPal (Legacy) cancel handlers in all versions up to, and including, 3.7.5, due to the cancel nonce using one action for every order (and so being the same for all logged-out visitors) and the handlers not checking that the supplied order belongs to the visitor's checkout session or is still unpaid. This makes it possible for unauthenticated attackers to permanently delete arbitrary orders, including paid ones.",
 "plugin": {
  "slug": "sunshine-photo-cart",
  "name": "Sunshine Photo Cart",
  "full_name": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers",
  "wordpress_org": "https://wordpress.org/plugins/sunshine-photo-cart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sunshine-photo-cart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8",
 "remediation": "Update to 3.8 or later.",
 "fix_released": "2026-10-21T20:42:30+00:00",
 "published": "2026-10-22T20:45:31+00:00",
 "updated": "2026-10-22T11:27:07.799371+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1474/",
  "https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/",
  "https://wordpress.org/plugins/sunshine-photo-cart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-22"
 }
}