CVE-2026-16561 — Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure

CVE-2026-16561

Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure PUBLISHED

Description (CNA)

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.

Affected (CNA)

Vendor / product	Versions
Unknown / Sunshine Photo Cart	affected 0 before 3.6.12

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/25bbf054-3b3f-4d88-899e-03d48055cbcd/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.