Privilege Escalation in Sunshine Photo Cart Plugin for WordPress
CVE-2025-5482
8.8HIGH
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 4 June 2025
What is CVE-2025-5482?
The Sunshine Photo Cart plugin for WordPress suffers from a privilege escalation flaw due to inadequate validation of a user-supplied key. This vulnerability affects all versions up to and including 3.4.11, allowing authenticated attackers with Subscriber-level access or higher to exploit the platform. Through the compromised password reset functionality, they can reset the passwords of any users, including those with administrative privileges, thus gaining unauthorized access to their accounts.
Affected Version(s)
Sunshine Photo Cart: Free Client Photo Galleries for Photographers * <= 3.4.11