CVE-2026-111842: Missing Authorization in WP Sunshine Sunshine Photo Cart

The vulnerability identified as CVE-2026-111842 affects WP Sunshine's Sunshine Photo Cart plugin. It is caused by missing authorization checks, which result in incorrectly configured access control security levels. This allows an attacker without privileges to perform actions that should be restricted, impacting the integrity of the system. The affected versions include all releases from initial versions up to but not including 3.8. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges required, but only integrity impact without confidentiality or availability impact.

Exploitation of this vulnerability could allow an unauthenticated attacker to perform unauthorized actions that modify data within the Sunshine Photo Cart plugin. There is no impact on confidentiality or availability reported. No known active exploitation has been observed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates and consider restricting access to the affected plugin functionality where possible.