The vulnerability is a missing authorization flaw that allows attackers to invoke functionality in the Sunshine Photo Cart WordPress plugin that is not properly restricted by access control lists. This enables unauthorized users to access administrative actions or data that should be limited to privileged roles. The weakness is identified as CWE-862, a broken access control issue.

The vulnerability affects the Sunshine Photo Cart plugin for WordPress for all releases up through and including version 3.5.3. The plugin is distributed by the vendor Sunshine Photo Cart. No other plugin versions or vendors are listed as affected.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of less than 1% suggests that current exploitation of this flaw is unlikely. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a web‑based request to the WordPress site hosting the plugin, where an attacker can send crafted HTTP requests to invoke restricted functions without proper authentication. The exploit would require that the attacker can interact with the site, such as via a publicly accessible account or a compromised user.