The plugin failure allows an authenticated user with Subscriber-level access or higher to reset the password of any other user, including administrators, by exploiting an unvalidated key. This grants full access to the victim's account, enabling the attacker to compromise confidentiality, integrity, and availability of the site. The weakness is a privilege escalation flaw (CWE-620).

Sunshine Photo Cart, a WordPress plugin, is affected in all versions up to and including 3.4.11. No specific vendor version details are provided beyond the maximum vulnerable release.

The vulnerability has a CVSS score of 8.8, indicating high severity, but the EPSS score is less than 1%, suggesting a low likelihood of exploitation at present. It is not listed in the CISA KEV catalog. Attackers need to be authenticated as a Subscriber or above, after which they can trigger the password reset function to impersonate any user. No remote code execution or other exploitation techniques are required beyond leveraging the existing password reset flow.