Privilege Escalation in Sunshine Photo Cart Plugin for WordPress
CVE-2025-5482

8.8HIGH

What is CVE-2025-5482?

The Sunshine Photo Cart plugin for WordPress suffers from a privilege escalation flaw due to inadequate validation of a user-supplied key. This vulnerability affects all versions up to and including 3.4.11, allowing authenticated attackers with Subscriber-level access or higher to exploit the platform. Through the compromised password reset functionality, they can reset the passwords of any users, including those with administrative privileges, thus gaining unauthorized access to their accounts.

Affected Version(s)

Sunshine Photo Cart: Free Client Photo Galleries for Photographers * <= 3.4.11

References

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Brian Sans-Souci
Audrey François
.
CVE-2025-5482 : Privilege Escalation in Sunshine Photo Cart Plugin for WordPress