CVE-2026-104730: CWE-502 Deserialization of Untrusted Data in sunshinephotocart Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers

The Sunshine Photo Cart WordPress plugin is affected by a PHP Object Injection vulnerability (CWE-502) in all versions up to and including 3.7.4. The vulnerability arises from deserialization of untrusted input, allowing unauthenticated attackers to inject PHP objects. No gadget (POP) chain is present within the plugin itself, so exploitation depends on the presence of a POP chain in other installed plugins or themes. If such a chain exists, attackers can leverage this vulnerability to perform arbitrary file deletion, data disclosure, or code execution by storing malicious payloads via the public favorites page and triggering deserialization when viewing images in private or non-viewable galleries.

The vulnerability has a critical impact (CVSS 9.8) because it allows unauthenticated remote attackers to inject PHP objects, potentially leading to arbitrary code execution, file deletion, or sensitive data disclosure. However, the impact depends on the presence of a POP chain in other installed plugins or themes. Without such a chain, the vulnerability cannot be exploited to cause harm.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should review installed plugins and themes for known POP chains and consider disabling or removing untrusted or unnecessary components that could enable exploitation. Monitoring for updates from the vendor is recommended.