CVE-2026-85037

Name of the Vulnerable Software and Affected Versions Sunshine Photo Cart versions prior to 3.7

Description The plugin contains an Insecure Direct Object Reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. The issue stems from missing validation of a client-supplied price identifier when an item is added to the cart. This allows unauthenticated users to manipulate the price by using an identifier defined elsewhere on the site, enabling them to purchase items at a lower cost and complete orders at that price.

Recommendations Update to version 3.7 or later.