Description (CNA)
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / Sunshine Photo Cart | affected 0 before 3.7 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.