CVE-2026-16561 is a missing authorization vulnerability (CWE-862) in the Sunshine Photo Cart WordPress plugin prior to version 3.6.12. The plugin fails to perform access control checks in a specific AJAX action, enabling unauthenticated attackers to retrieve comments associated with images in galleries that should be access-restricted, such as private or password-protected galleries. This issue compromises the confidentiality of comments tied to protected content.

The vulnerability allows unauthenticated attackers to bypass access controls and view comments on images within private or restricted galleries. This leads to unauthorized disclosure of potentially sensitive information contained in those comments. There is no indication of integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.6.12, upgrading to version 3.6.12 or later is recommended once a fix is confirmed. Until then, restrict access to the affected plugin or disable the vulnerable AJAX action if possible.