The Sunshine Photo Cart plugin for WordPress accepts comment submissions through the sunshine_modal_add_comment function without verifying that the user has permission to access the targeted gallery. This missing permission check is a CWE-345 flaw (Missing Permissions Checks). As a result, unauthenticated users can submit arbitrary comment payloads, including author name and e‑mail, to galleries that site owners have protected with passwords, email gating, private or account‑only settings, or by expiration. The inserted comments are displayed on the gallery pages, allowing attackers to add content to restricted galleries.

Any WordPress website running Sunshine Photo Cart plugin versions earlier than 3.7.4 is affected. The plugin’s comment submission handler, sunshine_modal_add_comment(), is the entry point for the vulnerability; no other product version or plugin is known to share this flaw.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. Its EPSS score is less than 1%, reflecting a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. The likely attack vector involves directing a crafted HTTP request to the sunshine_modal_add_comment endpoint while the target site has a restricted gallery. Because no authentication is required, attackers can freely submit arbitrary comment payloads; the plugin’s comment display routine then inadvertently reveals the injected content on the gallery pages.