CVE-2026-16561
Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
| Vendor | unknown |
| Product | sunshine photo cart |
| Published | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown sunshine photo cart
Be the first to know when new unknown vulnerabilities affecting unknown sunshine photo cart are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Sunshine Photo Cart
0 < 3.6.12
References
Credits
Farid Narimanov WPScan