The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all released versions up to and including 3.7.4. The flaw is caused by deserialization of the untrusted 'key' parameter without input validation, allowing an unauthenticated attacker to craft a malicious PHP object. The plugin itself does not expose a direct exploitation path for code execution; the injected object can only be abused if another component installed on the WordPress site contains a class that is susceptible to the same deserialization process, i.e., a POP chain. Without such a component the vulnerability is effectively inert.

The vulnerability affects any WordPress site running the Sunshine Photo Cart plugin version 3.7.4 or earlier. The plugin is typically used by photography businesses to host private galleries and photo proofing workflows. Sites using these versions are exposed regardless of their authentication settings because the vulnerable code can be triggered via public favorites or viewing private gallery pages.

The CVSS score of 9.8 indicates critical severity. Although no EPSS data is available, the flaw alone does not supply a direct payload; the likelihood of exploitation therefore hinges on the presence of a suitable POP chain in another plugin or theme on the same WordPress installation. If such a component is present, an unauthenticated user can submit a malicious object via the public favorites endpoint or by viewing a private gallery, which triggers deserialization. The injected object can then activate the POP chain, potentially enabling arbitrary file deletion, data exfiltration, or remote code execution. Without a vulnerable secondary component, the risk is effectively zero, but the governing vulnerability keeps the attack surface high for sites that are later updated with a susceptible plugin or theme.