CVE-2026-108069: Sunshine Photo Cart Authentication Bypass

CVE-2026-108069 Overview

CVE-2026-108069 affects the Sunshine Photo Cart WordPress plugin in versions before 3.7.4. The plugin fails to verify whether a visitor is permitted to access a restricted gallery before accepting comment submissions on its images. While access checks are enforced when displaying comments, they are absent at the comment submission endpoint. Unauthenticated attackers can inject attacker-chosen content with a chosen author name and email into galleries the owner has restricted through password protection, email gating, private status, account-only access, or expiration. The flaw is classified under CWE-345: Insufficient Verification of Data Authenticity.

Critical Impact
Unauthenticated attackers can inject arbitrary comment content into restricted photo galleries, bypassing password, email, account, and expiration-based access controls.

Affected Products

Sunshine Photo Cart WordPress plugin versions prior to 3.7.4
WordPress sites using gallery restriction features (password-protected, email-gated, private, account-only, or expired)
Any site deployment relying on Sunshine Photo Cart for restricted client galleries

Discovery Timeline

2026-10-14 - CVE CVE-2026-108069 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-108069

Vulnerability Analysis

The Sunshine Photo Cart plugin implements gallery restrictions to protect client photographs behind passwords, email gates, account requirements, or time-based expirations. The display logic correctly checks whether a visitor holds the necessary access token before rendering comments. The comment submission handler, however, omits this check entirely. An unauthenticated attacker who knows or guesses the image identifier can POST a comment to any restricted gallery without providing credentials.

The plugin accepts attacker-supplied values for the comment body, author name, and author email. These values are persisted against the target image and remain stored even though the submitter never satisfied the gallery's access requirements. Owners viewing their own galleries will see the injected comments as if they came from legitimate clients.

Root Cause

The root cause is an asymmetric authorization check between the read and write paths for gallery comments. The developers added access control to comment rendering but did not apply the same gatekeeping to the submission endpoint. This maps directly to [CWE-345], where the application fails to sufficiently verify the origin or authenticity of submitted data before accepting it.

Attack Vector

Exploitation requires only network access to the WordPress site and the ability to send an HTTP POST request to the comment submission endpoint. No authentication, user interaction, or elevated privileges are required. The attacker needs to identify the target image or gallery identifier, which may be enumerable or disclosed through other channels. A crafted POST request supplies the comment text along with a chosen display name and email, both of which are stored verbatim.

See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-108069

Indicators of Compromise

Comments appearing on restricted galleries from author names or email addresses not matching the client list approved by the gallery owner
Comment submission requests in web server logs targeting the Sunshine Photo Cart comment endpoint without a corresponding valid session cookie or access token
Unusual spikes in comment volume on galleries that are password-protected, private, or past their expiration date

Detection Strategies

Audit the plugin's comment database table for entries associated with restricted gallery identifiers and cross-reference submission timestamps against access-grant records
Inspect WordPress access logs for POST requests to Sunshine Photo Cart comment handlers originating from IP addresses that never retrieved the gallery's access form
Deploy web application firewall rules that correlate comment submissions with prior successful gallery authentication events

Monitoring Recommendations

Monitor WordPress plugin version inventory and flag any Sunshine Photo Cart installation below version 3.7.4
Alert on anomalous POST traffic volumes against gallery comment endpoints, particularly from unauthenticated sources
Review comment moderation queues on photography sites more frequently until all instances are patched

How to Mitigate CVE-2026-108069

Immediate Actions Required

Upgrade the Sunshine Photo Cart plugin to version 3.7.4 or later across all WordPress sites
Audit existing comments on restricted galleries and remove entries that cannot be attributed to authorized clients
Notify gallery owners whose restricted content may contain injected comments so they can review and remediate

Patch Information

The vendor addressed the issue in Sunshine Photo Cart version 3.7.4 by applying the same access verification used on the comment display path to the comment submission handler. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable commenting on galleries managed by Sunshine Photo Cart until the plugin can be updated
Deactivate the plugin on sites where immediate updates are not possible and restricted gallery integrity is critical
Place the WordPress site behind a web application firewall configured to require a valid gallery access cookie before permitting POSTs to the comment endpoint

bash

# Update Sunshine Photo Cart via WP-CLI
wp plugin update sunshine-photo-cart --version=3.7.4

# Verify installed version
wp plugin get sunshine-photo-cart --field=version