High severity · published Aug 5, 2026
CVE-2026-16561
Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Sunshine Photo Cart ·
before 3.6.12 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-16561
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-16561
wpscan.com
https://wpscan.com/vulnerability/25bbf054-3b3f-4d88-899e-03d48055cbcd/
More from Sunshine Photo Cart
5.3
CVE-2026-108069
Sunshine Photo Cart < 3.7.4 - Unauthenticated Content Injection via sunshine_modal_add_comment()
5.3
CVE-2026-85037
Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR