WordPress security changelog
MEDIUM CVE-2023-41796 Modified

Sunshine Photo Cart: Free Client Galleries for Photographers: A security weakness

Sunshine Photo Cart: Free Client Galleries for Photographers is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

CVE / CNA score 5.3 CVSS 3.1 · audit@patchstack.com
NVD score 6.5 CVSS 3.1 · nvd@nist.gov
Component
Sunshine Photo Cart: Free Client Galleries for Photographers
Plugin slug
sunshine-photo-cart
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Dec 20, 2023
Weakness
CWE-639 — Authorization Bypass Through User-Controlled Key

This CVE was published Dec 20, 2023 and is one of 23 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Sunshine Photo Cart: Free Client Galleries for Photographers to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: Free Client Galleries for Photographers: from n/a before 3.0.0.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

Primary and upstream sources