CVE-2025-5482: Sunshine Photo Cart Privilege Escalation

CVE-2025-5482 Overview

CVE-2025-5482 is a privilege escalation vulnerability in the Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress. All versions up to and including 3.4.11 are affected. The plugin fails to properly validate a user-supplied key in its password reset functionality [CWE-620]. Authenticated attackers with Subscriber-level access or above can change arbitrary user passwords, including those of administrators, and take over those accounts. The flaw enables full site compromise from any low-privilege account.

Critical Impact
Authenticated Subscriber-level attackers can reset administrator passwords and seize full control of affected WordPress sites.

Affected Products

Sunshine Photo Cart: Free Client Photo Galleries for Photographers (WordPress plugin)
All versions up to and including 3.4.11
WordPress sites with the plugin installed and active

Discovery Timeline

2025-06-04 - CVE-2025-5482 published to NVD
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-5482

Vulnerability Analysis

The vulnerability resides in the password reset workflow implemented in includes/functions/account.php. The plugin accepts a user-supplied key during the password reset process but fails to validate that key against the intended user. Because the key is not cryptographically tied to the requesting account, an authenticated attacker can submit a reset request targeting any user identifier on the site.

The attacker needs only Subscriber-level access, which is the lowest authenticated WordPress role and is granted by default on sites that allow user registration. After triggering the flawed reset path, the attacker sets a new password for the targeted user and authenticates as that user. When the target is an administrator, this yields full control of the WordPress installation, including plugin installation, theme editing, and database access.

This is a Trust of System-Unique IDs weakness, classified under [CWE-620] (Unverified Password Change). The plugin treats the supplied reset key as authoritative without verifying its origin or ownership.

Root Cause

The root cause is missing verification of the password reset key. The vulnerable code path accepts an arbitrary key parameter and proceeds to reset the password for the specified account without confirming the key was issued for that user. The patch in changeset 3305406 introduces proper key validation in the account functions file.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session at Subscriber level or higher. The attacker invokes the plugin's password reset endpoint with a target user identifier (such as the administrator account) and a crafted key value. The plugin updates the password without rejecting the request. The attacker then logs in as the administrator using the new credentials.

The vulnerability mechanism is described in the Wordfence Vulnerability Report and the WordPress Plugin Code Review.

Detection Methods for CVE-2025-5482

Indicators of Compromise

Unexpected password changes for administrator or editor accounts in the wp_users table
WordPress audit log entries showing password resets initiated by Subscriber-level accounts
New administrator logins from unfamiliar IP addresses immediately following a password reset event
HTTP POST requests to Sunshine Photo Cart account endpoints containing key parameters targeting other user IDs

Detection Strategies

Review WordPress activity logs for password reset events that target accounts other than the requester
Compare the installed Sunshine Photo Cart plugin version against 3.4.11 and flag any installation at or below this version
Inspect web server access logs for requests to plugin account handlers originating from low-privilege sessions

Monitoring Recommendations

Enable a WordPress security plugin or SIEM forwarder to capture authentication and user metadata changes
Alert on any modification of the user_pass field for privileged accounts
Track the creation of new Subscriber accounts followed shortly by password reset activity against administrators

How to Mitigate CVE-2025-5482

Immediate Actions Required

Update the Sunshine Photo Cart plugin to a version newer than 3.4.11 that includes the fix from changeset 3305406
Audit all administrator and editor accounts for unauthorized password changes and reset credentials where compromise is suspected
Disable open user registration on affected sites until the plugin is patched
Review and revoke any active sessions for privileged accounts after patching

Patch Information

The vendor addressed the vulnerability in the trunk update tracked as WordPress Plugin Changeset 3305406. The fix introduces proper validation of the password reset key in includes/functions/account.php so that the key must match the targeted user before any password change is permitted.

Workarounds

Deactivate and remove the Sunshine Photo Cart plugin until the patched version can be installed
Restrict user registration to trusted users only and require manual approval for new Subscriber accounts
Place the WordPress administration area behind an IP allowlist or additional authentication layer such as HTTP basic auth

bash

# Configuration example: disable open registration in wp-config.php or via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber