{
 "id": "WPSEC-2026-1475",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1475/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1475/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1475/index.md",
 "title": "Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via PayPal (Legacy) IPN",
 "description": "The Sunshine Photo Cart plugin for WordPress is vulnerable to Payment Bypass via the PayPal (Legacy) IPN handler in all versions up to, and including, 3.7.5, due to the handler completing the order named in the 'custom' field of any PayPal-verified IPN without checking the receiving account, payment status, currency or amount. This makes it possible for unauthenticated attackers to have an order marked as paid by making a much smaller PayPal payment, or a payment to a different PayPal account, that points its notification at the store.",
 "plugin": {
  "slug": "sunshine-photo-cart",
  "name": "Sunshine Photo Cart",
  "full_name": "Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers",
  "wordpress_org": "https://wordpress.org/plugins/sunshine-photo-cart/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sunshine-photo-cart/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-345"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8",
 "remediation": "Update to 3.8 or later.",
 "fix_released": "2026-10-21T20:42:30+00:00",
 "published": "2026-10-22T20:45:31+00:00",
 "updated": "2026-10-22T11:27:07.799371+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1475/",
  "https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/",
  "https://wordpress.org/plugins/sunshine-photo-cart/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sunshine-photo-cart",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-22"
 }
}