The vulnerability is a missing authorization flaw in the WordPress Sunshine Photo Cart plugin, enabling attackers to access or modify resources beyond their intended permissions. This flaw arises from incorrectly configured access control security levels, permitting an attacker to gain unauthorized access to the plugin’s administrative functions or user data. The weakness is classified as CWE‑862, indicating lack of proper authorization checks.

The affected product is the Sunshine Photo Cart plugin for WordPress, versions up to and including 3.7.4. All installations running any version older than or equal to 3.7.4 are potentially vulnerable.

The CVSS base score of 5.3 indicates a medium severity vulnerability. The EPSS score of < 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Likely attack vectors involve accessing the plugin’s management pages or API endpoints without the requisite role checks; an attacker with any level of access to the WordPress installation could exploit the weak authorization to perform unauthorized actions.