Vulnerabilities / Sunshine Photo Cart / WPSEC-2026-1475
Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via PayPal (Legacy) IPN
High 7.5
CWE-345Fixed in 3.8
- ID
- WPSEC-2026-1475
- Plugin
- Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers (sunshine-photo-cart)
- Affected
- all versions before 3.8
- Remediation
- Update to 3.8 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-345
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Sunshine Photo Cart on WPSec AttackSurface
- Fix released
- Published
Description
The Sunshine Photo Cart plugin for WordPress is vulnerable to Payment Bypass via the PayPal (Legacy) IPN handler in all versions up to, and including, 3.7.5, due to the handler completing the order named in the 'custom' field of any PayPal-verified IPN without checking the receiving account, payment status, currency or amount. This makes it possible for unauthenticated attackers to have an order marked as paid by making a much smaller PayPal payment, or a payment to a different PayPal account, that points its notification at the store.
References
- https://wpsec.com/vuln/WPSEC-2026-1475/
- https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/
- https://wordpress.org/plugins/sunshine-photo-cart/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS