CVE-2026-104730: WordPress Sunshine Photo Cart Plugin Flaw

CVE-2026-104730 Overview

CVE-2026-104730 is a PHP Object Injection vulnerability in the Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress. The flaw affects all versions up to and including 3.7.4 and stems from deserialization of untrusted input [CWE-502]. Unauthenticated attackers can inject arbitrary PHP objects by storing a malicious payload through the public favorites page. Deserialization is triggered when any image in a non-viewable or private gallery is viewed. The plugin itself does not ship a Property Oriented Programming (POP) chain, so impact depends on other installed plugins or themes providing one.

Critical Impact
When a POP chain is present via another installed plugin or theme, attackers can delete arbitrary files, exfiltrate sensitive data, or execute arbitrary code on the WordPress site without authentication.

Affected Products

Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress
All versions up to and including 3.7.4
WordPress sites with any additional plugin or theme exposing a usable POP chain

Discovery Timeline

2026-10-16 - CVE-2026-104730 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-104730

Vulnerability Analysis

The plugin passes attacker-controlled input to PHP's unserialize() function without validating or sanitizing the serialized data. This allows an unauthenticated user to craft a serialized PHP object and have it instantiated on the server. Because the vulnerable path is reachable through the public favorites page, no authentication or user interaction is required to store the payload. The payload is later deserialized when a visitor requests any image in a non-viewable or private gallery, giving attackers a reliable write-then-trigger primitive.

The plugin alone does not define a magic method chain that performs dangerous operations. However, PHP Object Injection is a composable primitive: if any other installed component (plugin, theme, or shared library) exposes a POP chain with destructive __destruct, __wakeup, or similar magic methods, the attacker can pivot to arbitrary file deletion, sensitive data disclosure, or arbitrary code execution.

Root Cause

The root cause is unsafe deserialization of untrusted input in the frontend request handling and session logic of the plugin. Relevant code paths are documented in class-frontend.php, class-image.php, and class-session.php within the 3.7.3 source tree, where attacker-controlled values flow into deserialization routines without a type-safe parser or integrity check.

Attack Vector

An unauthenticated remote attacker submits a serialized PHP payload through the plugin's public favorites functionality. The payload is persisted server-side. The attacker, or any subsequent visitor, then loads an image belonging to a non-viewable or private gallery, which causes the stored payload to be deserialized. Successful exploitation depends on the presence of a POP chain supplied by a co-installed plugin or theme.

See the Wordfence Vulnerability Report and the vulnerable source files in class-frontend.php, class-image.php, and class-session.php for technical details.

Detection Methods for CVE-2026-104730

Indicators of Compromise

Unauthenticated POST requests to the Sunshine Photo Cart favorites endpoint containing serialized PHP markers such as O:, a:, or s: followed by length-prefixed object names
Unexpected files created, modified, or deleted under the WordPress document root following gallery image views
PHP error log entries referencing unserialize(), __wakeup, or __destruct originating from sunshine-photo-cart include files
Outbound network connections or new PHP files appearing in wp-content/uploads/ shortly after public favorites traffic

Detection Strategies

Inspect web server access logs for requests to Sunshine Photo Cart frontend handlers carrying body or query parameters that match PHP serialization patterns
Alert on sequences where an unauthenticated favorites submission is followed by image requests against non-viewable or private gallery IDs
File integrity monitoring on WordPress core, plugin, theme, and wp-config.php to catch tampering triggered by POP chain execution

Monitoring Recommendations

Enable PHP error and audit logging to capture deserialization errors and unexpected magic method invocations
Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for correlation across hosts
Review installed plugins and themes for components known to expose POP chains and track their versions over time

How to Mitigate CVE-2026-104730

Immediate Actions Required

Update the Sunshine Photo Cart plugin to a version later than 3.7.4 that remediates the deserialization sink
If no fixed version is available on your installation channel, deactivate and remove the plugin until a patch is applied
Audit the site for other plugins or themes that provide POP chains and remove or update them
Rotate WordPress administrator credentials, API keys, and database secrets if post-exploitation activity is suspected

Patch Information

Review the plugin Changeset Log for the committed fix and upgrade to the patched release referenced by the vendor advisory. Verify the installed version via the WordPress admin plugins page after upgrade.

Workarounds

Place a Web Application Firewall (WAF) rule in front of the favorites endpoint to block request bodies containing PHP serialization syntax
Restrict public access to Sunshine Photo Cart frontend URLs using IP allowlists or authentication gating until patched
Remove private and non-viewable galleries temporarily to prevent the deserialization trigger from firing

bash

# Example ModSecurity rule to block serialized PHP objects in request bodies
SecRule REQUEST_URI "@contains /sunshine-photo-cart" \
  "id:1026104730,phase:2,deny,status:403,log,\
   msg:'CVE-2026-104730 PHP Object Injection attempt',\
   chain"
  SecRule REQUEST_BODY "@rx (?i)(O|a|s):[0-9]+:\"" \
    "t:none,t:urlDecodeUni"