Critical PHP Object Injection Flaw Found in Sunshine Photo Cart WordPress Plugin

The Sunshine Photo Cart plugin for WordPress contains a critical security flaw that allows unauthenticated attackers to inject PHP objects. The National Vulnerability Database assigned CVE-2026-104730 a CVSS score of 9.8, classifying the issue as critical. The defect exists in all versions of the plugin released up to and including version 3.7.4.

The vulnerability stems from the deserialization of untrusted input, categorized under CWE-502. According to the NVD record, an attacker can store a malicious payload on the public favorites page without authentication. Triggering the deserialization occurs when a user views any image located in a non-viewable or private gallery. This mechanism allows the injection to execute on the server side.

Context and Background

The NVD record explicitly states that no known PHP Object Injection (POP) chain is present within the Sunshine Photo Cart software itself. This means the vulnerability has no direct impact unless another plugin or theme containing a POP chain is installed on the same site. The presence of such a chain in a third-party component is a prerequisite for exploitation.

If a compatible POP chain exists via an additional plugin or theme, the attacker can leverage it to perform various actions. These actions may include deleting arbitrary files, retrieving sensitive data, or executing code on the server. The specific capabilities depend entirely on the POP chain present in the additional software installed on the target system.

Who Is Affected

Website administrators using the Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin are affected if they run versions up to 3.7.4. The risk is elevated for sites that also utilize other plugins or themes known to contain exploitable POP chains. Sites running only this plugin and no other vulnerable components are not directly impacted by this specific flaw.

The exposure is public because the initial payload storage occurs via the public favorites page. This means attackers do not need valid login credentials to place the malicious data. The trigger condition, viewing an image in a restricted gallery, is a common user action that can be induced or monitored by an attacker.

What should you do?

Security teams should audit their WordPress installations for the presence of the Sunshine Photo Cart plugin. Administrators must verify the installed version against the affected range ending at 3.7.4. If the plugin is present, they should assess whether other plugins or themes on the site contain known POP chains.