A missing authorization vulnerability in the Sunshine Photo Cart plugin could allow authenticated users to perform unauthorized actions, potentially leading to data manipulation.

This is a CWE-862 Missing Authorization flaw where the plugin fails to perform adequate capability checks on specific functions. The CVSS vector (PR:L) confirms that an attacker must be an authenticated user to exploit this vulnerability.

While the provided CVSS score is 9.1, the technical impact is limited to partial authorization bypass within the plugin's scope. Successful exploitation could allow a low-privileged user to access or modify resources they are not authorized to interact with, potentially compromising the integrity of photo galleries or customer data.

Immediate Action: Update the Sunshine Photo Cart plugin to version 3.5.7.2 or later immediately.

Proactive Monitoring: Audit WordPress user logs for unexpected administrative actions or access to plugin-specific settings by non-administrative accounts.

Compensating Controls: Ensure that plugin access is restricted via Web Application Firewall (WAF) rules that block unauthorized attempts to invoke sensitive plugin functions.

Public Exploit Available: Unknown

Given the potential for unauthorized data manipulation, administrators should prioritize updating the Sunshine Photo Cart plugin to the latest version. Patching is the only effective way to remediate the underlying authorization logic error.