The Sunshine Photo Cart plugin contains a missing authorization flaw that allows attackers to bypass security checks and access functions that should be restricted to privileged users. The vulnerability is classified as CWE‑862. The CVE description does not specify which particular operations are exposed, but indicates that incorrect configuration of security levels is the root cause.

WordPress sites running the Sunshine Photo Cart plugin version 3.7.5 or earlier are affected; the vendor’s range states from n/a through 3.7.5, meaning any release in that series prior to 3.8 is vulnerable. Only the plugin is listed as impacted, with no mention of WordPress core or other plugins.

The CVSS score of 5.3 reflects moderate severity and represents a moderate impact on confidentiality, integrity, and availability of the plugin’s data. The EPSS score is not available, so the probability of exploitation cannot be quantified, and the vulnerability is not in CISA KEV, indicating no publicly documented exploits. Based on the description, the likely attack vector is web requests to the plugin’s interface or endpoints, allowing attackers with internet access to send crafted requests that bypass access checks if the plugin’s security levels are misconfigured.