Description

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-16T07:17:08.267Z",
  "pubdate": "2026-10-16T07:17:08.267Z",
  "executiveSummary": "The Sunshine Photo Cart plugin for WordPress, in all versions up to and including 3.7.4, is vulnerable to a PHP Object Injection flaw. This vulnerability arises from the improper deserialization of untrusted input provided by users. An unauthenticated attacker can exploit this weakness by supplying a malicious serialized object, which is then processed by the application.\nThe primary risk associated with this vulnerability is the potential for Remote Code Execution (RCE), arbitrary file deletion, or sensitive data exposure. However, the successful execution of these impacts is contingent upon the presence of a Property Oriented Programming (POP) chain within the vulnerable site's environment, such as one residing in a secondary installed plugin or theme. If such a chain exists, the attacker can leverage the deserialization process to instantiate objects and invoke methods that lead to unauthorized actions. Exploitation can be achieved by an unauthenticated attacker, specifically by interacting with the public favorites page to store a payload and triggering the deserialization by accessing restricted images within a gallery. Given the potential for complete system compromise if a POP chain is present, this vulnerability is considered a significant security risk for WordPress installations utilizing this plugin.",
  "technicalDetails": "The vulnerability originates from the insecure use of PHP's unserialize() function on untrusted user-supplied data within the Sunshine Photo Cart plugin. In PHP, the unserialize() function converts a stored value back into a PHP object. If an application deserializes untrusted data, an attacker can supply a specially crafted serialized string that instructs the application to instantiate an object of any class currently defined in the application's scope.\nWhile the Sunshine Photo Cart codebase itself may not contain a POP chain, the vulnerability relies on the existence of gadget classes within the environment. A POP chain consists of a sequence of method calls, often triggered by magic methods like __destruct(), __wakeup(), or __toString(). When the application deserializes the attacker-controlled object, the magic methods are triggered, potentially leading to unauthorized execution of code or system operations.\nThe attack flow proceeds as follows: First, the unauthenticated attacker crafts a malicious serialized PHP object designed to interact with a known POP chain on the target system. Second, the attacker transmits this payload to the server, typically through the plugin's public favorites page functionality, where it is stored. Third, the attacker triggers the deserialization process by viewing an image associated with a non-viewable or private gallery. When the application processes the request, the underlying unserialize() function processes the stored malicious string. If the object's structure aligns with a gadget chain present in another plugin or the active theme, the exploit is executed during the object's lifecycle.\nThe vulnerability is present in versions up to and including 3.7.4. It requires no authentication to reach the vulnerable entry point, making it reachable from the network by any visitor to the WordPress site. The impact is entirely dependent on the specific POP chains available in the site's environment. Without a POP chain, the deserialization does not result in an actionable exploit, but the presence of even a single vulnerable gadget in the ecosystem transforms this into a critical entry point for post-exploitation activities, including full site compromise, file system manipulation, and data exfiltration."
}