WordPress Sunshine Photo Cart Unauthenticated Private Gallery Comment Disclosure (CVE-2026-16561)

Vulnerability Overview Vulnerability Name: Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure Description: The plugin fails to enforce access control checks in one of its AJAX operations, allowing unauthorized users to retrieve image comments belonging to private, password-protected, or otherwise access-restricted galleries. CVE ID: CVE-2026-16561 Classification: - Type: NO AUTHORISATION - OWASP Top 10: AS: Broken Access Control - CWE: CWE-862 - CVSS: 5.3 (medium) Affected Scope Affected Plugin: sunshine-photo-cart Fixed Version: 3.6.12 Remediation Fixed Version: Upgrade to version 3.6.12 or higher. Timeline Public Disclosure Date: 2026-07-27 Added Date: 2026-07-27 Last Updated: 2026-07-27 Additional Information Original Researcher: Farid Narimanov Submitter: Farid Narimanov Verification Status: Yes WPVDB ID: 25bbf054-3b3f-4d88-899e-03d48055cbcd POC Code POC Code: The page mentions that the POC will be revealed on August 10, 2026, to give users time to update. The specific code is not provided. References CVE Link: CVE-2026-16561 Related Vulnerabilities Image Hover Effects Ultimate < 9.7.2 - Authenticated Arbitrary Options Change WP Travel Engine - Tour Booking Plugin - Tour Operator Software < 6.7.11 - Missing Authorization CitiLights < 3.7.2 - Missing Authorization Secure Copy Content Protection and Content Locking < 5.0.1 - Missing Authorization Pardot < 2.1.1 - Missing Authorization The above is a summary of the key information regarding the vulnerability extracted from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Sunshine Photo Cart Unauthenticated Private Gallery Comment Disclosure (CVE-2026-16561)

More from this source