The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress contains an improper access control vulnerability (CWE-284) identified as CVE-2024-1294. In all versions up to and including 3.0.24, unauthenticated attackers can exploit the 'invoice' feature to extract sensitive customer data, including email addresses and physical addresses. The vulnerability has a CVSS 3.1 base score of 5.3, indicating medium severity, with an attack vector of network, no privileges or user interaction required, and confidentiality impact limited to partial data disclosure.

Exploitation of this vulnerability allows unauthenticated attackers to retrieve sensitive customer information such as email and physical addresses from the affected plugin. This exposure could lead to privacy violations and potential follow-on attacks targeting customers. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed as no official patch or vendor advisory is provided. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a fix is available, consider restricting access to the affected functionality or disabling the plugin if feasible to prevent unauthorized data exposure.