WordPress security changelog
MEDIUM CVE-2024-50463 Modified

Sunshine Photo Cart: An open redirect

Sunshine Photo Cart is affected by an open redirect. Exposure depends on how the affected operation is made reachable by the site. A crafted link can redirect visitors from the trusted site to an attacker-controlled destination.

CVE / CNA score 4.7 CVSS 3.1 · audit@patchstack.com
NVD score 6.1 CVSS 3.1 · nvd@nist.gov
Component
Sunshine Photo Cart
Plugin slug
sunshine-photo-cart
Affected
See vendor advisory
Safe version
See mitigation notes
Published
Oct 28, 2024
Weakness
CWE-601 — URL Redirection to Untrusted Site ('Open Redirect')

This CVE was published Oct 28, 2024 and is one of 23 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Sunshine Photo Cart to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

NVD vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Primary and upstream sources