CVE-2026-24994

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24994", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-01-28T09:50:51.018Z", "datePublished": "2026-02-03T14:08:37.221Z", "dateUpdated": "2026-04-28T16:14:52.997Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "sunshine-photo-cart", "product": "Sunshine Photo Cart", "vendor": "sunshinephotocart", "versions": [{"changes": [{"at": "3.5.7.3", "status": "unaffected"}], "lessThanOrEqual": "3.5.7.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:01.537Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.</p>"}], "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:52.997Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-5-7-2-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-03T16:37:03.770436Z", "id": "CVE-2026-24994", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T15:39:51.751Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24994", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-03T16:37:03.770436Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T16:36:18.081Z"}}], "cna": {"title": "WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "sunshinephotocart", "product": "Sunshine Photo Cart", "versions": [{"status": "affected", "changes": [{"at": "3.5.7.3", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.5.7.2"}], "packageName": "sunshine-photo-cart", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-28T13:26:33.209Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-5-7-2-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T12:10:47.804Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24994", "state": "PUBLISHED", "dateUpdated": "2026-04-28T15:39:51.751Z", "dateReserved": "2026-01-28T09:50:51.018Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-03T14:08:37.221Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "sunshine-photo-cart", "product": "Sunshine Photo Cart", "vendor": "sunshinephotocart", "versions": [{"changes": [{"at": "3.5.7.3", "status": "unaffected"}], "lessThanOrEqual": "3.5.7.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2."}, {"lang": "es", "value": "Vulnerabilidad por Autorizaci\u00f3n Ausente en sunshinephotocart Sunshine Photo Cart sunshine-photo-cart permite Explotar Niveles de Seguridad de Control de Acceso Incorrectamente Configurados. Este problema afecta a Sunshine Photo Cart: desde n/a hasta &lt;= 3.5.7.2."}], "id": "CVE-2026-24994", "lastModified": "2026-06-17T10:23:56.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24994", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-03T16:37:03.770436Z", "version": "2.0.3"}}]}, "published": "2026-02-03T15:16:18.510", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-5-7-2-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-16T01:15:30.785074+00:00", "value": {"mitigation_remediation": ["Upgrade Sunshine Photo Cart to a version later than 3.5.7.2.", "Verify that the plugin's access control settings are properly configured, ensuring that privilege management functions restrict access to authorized roles only.", "Monitor WordPress logs for suspicious activity that might indicate exploitation attempts, and consider tightening site firewall rules around the plugin's endpoints."], "summary": {"action": "Patch", "impact": "Unauthorized access to protected plugin functionality"}, "threat_synthesis": {"affected_systems": "Sunshine Photo Cart plugin for WordPress, versions up through 3.5.7.2. The issue affects any site running this plugin that has not been updated beyond that version.", "description_and_impact": "The vulnerability is a missing authorization flaw that allows attackers to bypass correctly configured access control mechanisms within the Sunshine Photo Cart plugin. It permits unauthorized users to access or modify protected resources that should be restricted. This flaw can lead to data exposure or tampering, impacting confidentiality, integrity, and potentially availability of the photo cart data. The weakness is identified as CWE\u2011862 Authentication Failures.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests the likelihood of exploitation remains low under current threat intelligence. The vulnerability is not listed in CISA's KEV catalog, implying no publicly known exploit yet. Attackers would typically need to interact with the plugin's web interface, exploit the misconfigured access control to gain elevated permissions. No specific exploit code is known, so the risk is largely dependent on the plugin's deployment context and user permissions."}}}}, "created": "2026-02-04T12:09:07.669698+00:00", "updated": "2026-04-16T01:30:20.299471+00:00", "vendors": ["sunshinephotocart", "sunshinephotocart$PRODUCT$sunshine_photo_cart", "wordpress", "wordpress$PRODUCT$wordpress"]}