WordPress users running the Sunshine Photo Cart plugin before version 3.6.2 may experience a privacy breach. The plugin’s code inserts sensitive information into responses that are sent to the client, allowing anyone who can invoke the vulnerable functionality to retrieve confidential data such as private images, transaction details, or customer credentials. The flaw is a classic Injection of Sensitive Information into Sent Data (CWE‑201) vulnerability, where data that should not be exposed is inadvertently included in the output.

All WordPress installations that have not updated the Sunshine Photo Cart plugin to at least version 3.6.2 are affected. This includes every release from the plugin's initial launch up through any version older than 3.6.2, meaning that any site using the plugin without the patch is potentially compromised.

The CVSS score of 5.3 classifies the issue as moderate, and the EPSS score of less than 1 % indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, so no widespread attacks are currently known. The likely attack vector is sending crafted HTTP requests to the plugin's exposed endpoints or simply viewing publicly available pages; authentication is not required to access the sensitive data as the plugin emits it in regular responses.