# Sunshine Photo Cart <= 3.7.5 - Unauthenticated Payment Bypass via PayPal (Legacy) IPN

- **ID:** WPSEC-2026-1475
- **Plugin:** Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers (`sunshine-photo-cart`), https://wordpress.org/plugins/sunshine-photo-cart/
- **Affected versions:** all versions before 3.8
- **Fixed in:** 3.8 (Update to 3.8 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-345
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sunshine-photo-cart
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1475/

## Description

The Sunshine Photo Cart plugin for WordPress is vulnerable to Payment Bypass via the PayPal (Legacy) IPN handler in all versions up to, and including, 3.7.5, due to the handler completing the order named in the 'custom' field of any PayPal-verified IPN without checking the receiving account, payment status, currency or amount. This makes it possible for unauthenticated attackers to have an order marked as paid by making a much smaller PayPal payment, or a payment to a different PayPal account, that points its notification at the store.

## References

- https://wpsec.com/vuln/WPSEC-2026-1475/
- https://plugins.svn.wordpress.org/sunshine-photo-cart/tags/3.8/
- https://wordpress.org/plugins/sunshine-photo-cart/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1475/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.