The vulnerability identified as CVE-2026-39564 affects Sunshine Photo Cart versions before 3.6.2. It involves the insertion of sensitive information into data sent by the application, allowing an attacker to retrieve embedded sensitive data remotely without authentication or user interaction. The CVSS 3.1 base score is 5.3 (medium), with attack vector network, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality but does not affect integrity or availability. No official patch or vendor advisory detailing remediation is currently available.

An attacker can remotely retrieve sensitive information embedded in data sent by Sunshine Photo Cart without needing privileges or user interaction. This exposure affects confidentiality but does not impact data integrity or system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations are provided by the vendor at this time.