# Sunshine Photo Cart <= 3.7.5 - Unauthenticated Insecure Direct Object Reference to Arbitrary Order Deletion

- **ID:** WPSEC-2026-1474
- **Plugin:** Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers (`sunshine-photo-cart`), https://wordpress.org/plugins/sunshine-photo-cart/
- **Affected versions:** all versions before 3.8
- **Fixed in:** 3.8 (Update to 3.8 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sunshine-photo-cart
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1474/

## Description

The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'order_id' parameter of the Stripe hosted checkout and PayPal (Legacy) cancel handlers in all versions up to, and including, 3.7.5, due to the cancel nonce using one action for every order (and so being the same for all logged-out visitors) and the handlers not checking that the supplied order belongs to the visitor's checkout session or is still unpaid. This makes it possible for unauthenticated attackers to permanently delete arbitrary orders, including paid ones.

## References

- https://wpsec.com/vuln/WPSEC-2026-1474/
- https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/
- https://wordpress.org/plugins/sunshine-photo-cart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1474/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.