The Sunshine Photo Cart plugin for WordPress is vulnerable to PHP Object Injection due to deserialization of untrusted input in versions up to and including 3.7.4. This vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to arbitrary file deletion, sensitive data retrieval, or code execution if a POP chain is present via another plugin or theme.
A vulnerability was found in Sunshine Photo Cart, a plugin for WordPress. The issue affects an unknown part of the plugin, specifically the handling of sensitive information. The manipulation leads to insertion of sensitive information into sent data, potentially allowing attackers to retrieve embedded sensitive data. The CVE record was published on 2026-04-08T09:16:27.637Z and was last modified on 2026-0 [truncated]
