PHP Object Injection Vulnerability in Sunshine Photo Cart by WordPress

CVE-2026-104730

What is CVE-2026-104730?

The Sunshine Photo Cart plugin for WordPress is susceptible to PHP Object Injection due to improper deserialization of untrusted input in versions up to and including 3.7.4. This vulnerability allows unauthenticated attackers to inject malicious PHP objects. While the vulnerable software does not contain a known PHP Object Pollution (POP) chain by itself, the presence of other plugins or themes with POP chains could enable attackers to perform severe actions, such as deleting arbitrary files, accessing sensitive data, or executing arbitrary code. Attackers can exploit this vulnerability through the public favorites page and trigger deserialization by merely viewing images in private or non-viewable galleries.

References