{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67973", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-15T10:00:28.856Z", "datePublished": "2026-02-20T15:46:29.373Z", "dateUpdated": "2026-04-28T16:14:24.956Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "sunshine-photo-cart", "product": "Sunshine Photo Cart", "vendor": "sunshinephotocart", "versions": [{"changes": [{"at": "3.5.7.1", "status": "unaffected"}], "lessThanOrEqual": "3.5.6.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-22T14:20:27.024Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.</p>"}], "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:24.956Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-5-6-2-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Sunshine Photo Cart plugin <= 3.5.6.2 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:59:41.349074Z", "id": "CVE-2025-67973", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T18:09:01.087Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67973", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:59:41.349074Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:59:57.376Z"}}], "cna": {"title": "WordPress Sunshine Photo Cart plugin <= 3.5.6.2 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Legion Hunter | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "sunshinephotocart", "product": "Sunshine Photo Cart", "versions": [{"status": "affected", "changes": [{"at": "3.5.7.1", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "3.5.6.2"}], "packageName": "sunshine-photo-cart", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-22T14:20:27.024Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-5-6-2-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-23T14:13:55.343Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67973", "state": "PUBLISHED", "dateUpdated": "2026-04-27T18:09:01.087Z", "dateReserved": "2025-12-15T10:00:28.856Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-20T15:46:29.373Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2."}, {"lang": "es", "value": "Vulnerabilidad de autorizaci\u00f3n faltante en sunshinephotocart Sunshine Photo Cart sunshine-photo-cart permite la explotaci\u00f3n de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a Sunshine Photo Cart: desde n/a hasta &lt;= 3.5.6.2."}], "id": "CVE-2025-67973", "lastModified": "2026-04-27T18:16:51.997", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-02-20T16:22:03.557", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-5-6-2-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.5.6.2]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Sunshine Photo Cart", "source": "cna", "vendor": "sunshinephotocart"}, "product": "sunshine_photo_cart", "vendor": "sunshinephotocart"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-27T20:58:57.823682+00:00", "value": {"mitigation_remediation": ["Upgrade Sunshine Photo Cart to the latest released version (or at least to 3.5.6.3 if available) to eliminate the missing authorization issue.", "If a patch is not immediately available, restrict the plugin\u2019s administrative interfaces to trusted IP addresses using web\u2011server or firewall rules so that only authorized hosts can reach them.", "Ensure that the plugin\u2019s role\u2011based access controls are correctly configured so that only users with the proper privileges can perform privileged actions such as viewing or deleting photos.", "Monitor WordPress audit logs for unexpected or privileged activity that originates from the Sunshine Photo Cart plugin."], "summary": {"action": "Patch Immediately", "impact": "Unauthorized Access Control Bypass"}, "threat_synthesis": {"affected_systems": "Sunshine Photo Cart plugin for WordPress versions up to and including 3.5.6.2.", "description_and_impact": "The vulnerability is a missing authorization flaw in the Sunshine Photo Cart WordPress plugin that allows attackers to bypass the intended access controls prescribed by role\u2011based permissions. An attacker could exploit specially crafted HTTP requests to access or modify plugin configuration and photo data that should only be reachable by privileged users.", "risk_and_exploitability": "The CVSS score of 6.5 indicates moderate severity for this missing authorization weakness, which is classified as CWE\u2011862. The EPSS score of less than 1% shows a low observed probability of exploitation in the wild, and the issue is not listed in the CISA KEV catalog. Nevertheless, an attacker could target the plugin\u2019s endpoints, sending requests that are not adequately restricted by authentication checks. The flaw could be leveraged by authenticated users with insufficient roles or potentially by unauthenticated users if the plugin\u2019s administrative pages are publicly accessible. The absence of an KEV listing does not lessen the practical risk for any WordPress installation that remains exposed to the Internet."}}}}, "created": "2026-02-23T14:46:24.365057+00:00", "updated": "2026-04-27T21:00:13.178487+00:00", "vendors": ["sunshinephotocart", "sunshinephotocart$PRODUCT$sunshine_photo_cart", "wordpress", "wordpress$PRODUCT$wordpress"]}