PT-2026-67976 · Unknown · Sunshine Photo Cart

Farid Narimanov

·

CVE-2026-16561

·

Published

2026-08-05

·

Updated

2026-08-05

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Sunshine Photo Cart versions prior to 3.6.12
Description An issue exists where the plugin fails to perform access control checks in an AJAX action. This allows unauthenticated users to retrieve comments from images located within private, password-protected, or otherwise access-restricted galleries.
Recommendations Update Sunshine Photo Cart to version 3.6.12 or later.

Exploit

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-16561

Affected Products

Sunshine Photo Cart