CVE-2026-16561

7.5 HIGH

Published 2026-08-05 · Updated 2026-08-05

AI risk analysis

Summary: The flaw allows unauthenticated users to access private image comments through a vulnerable AJAX action in Sunshine Photo Cart WordPress plugin versions prior to 3.6.12, compromising privacy and security.
Exploitability: Exploitation is relatively easy as no authentication is required; attackers need only trigger the specific AJAX action.
Blast radius: If exploited, this could lead to unauthorized access to sensitive comments in private galleries, impacting user trust and site integrity.
Prioritized remediation: Update to Sunshine Photo Cart version 3.6.12 or later to apply necessary security patches.

auth-bypasswebprivacy

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherwise access-restricted galleries.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses

CWE-862

All references

https://wpscan.com/vulnerability/25bbf054-3b3f-4d88-899e-03d48055cbcd/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.