CVE-2026-109689: Missing Authorization in WP Sunshine Sunshine Photo Cart

The vulnerability identified as CVE-2026-109689 affects WP Sunshine's Sunshine Photo Cart plugin through version 3.7.4. It is a missing authorization issue caused by incorrectly configured access control security levels, which could allow unauthorized network attackers to access certain information. The CVSS 3.1 vector indicates the attack vector is network-based, requires no privileges or user interaction, and impacts confidentiality with a low impact, but does not affect integrity or availability.

Exploitation of this vulnerability could lead to unauthorized disclosure of information due to missing authorization checks. There is no indication of impact on data integrity or system availability. The medium severity reflects the potential confidentiality impact without further critical consequences.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor WP Sunshine's official channels for updates and apply any forthcoming patches promptly. Until then, consider restricting network access to the affected plugin functionalities if feasible.