An unauthenticated authorization bypass in the Sunshine Photo Cart WordPress plugin allows unauthorized users to access restricted content, including comments on private galleries.

The plugin fails to perform necessary capability checks on specific AJAX actions. This allows an unauthenticated user to retrieve comments associated with private, password-protected, or otherwise restricted photo galleries.

This vulnerability results in unauthorized information disclosure, potentially compromising private client communications or sensitive metadata stored within image comments. Given the CVSS score of 7.5, this issue undermines the privacy expectations of users utilizing the platform for protected content, posing a risk to data confidentiality.

Immediate Action: Update the Sunshine Photo Cart plugin to version 3.6.12 or later to implement the required access control checks.

Proactive Monitoring: Review server access logs for anomalous requests targeting AJAX endpoints related to gallery comments.

Compensating Controls: Use a Web Application Firewall to block unauthorized access to the specific plugin AJAX actions if the patch cannot be applied immediately.

Public Exploit Available: Unknown.

Unauthorized access to private gallery data is a significant privacy concern for businesses relying on this plugin. Administrators are advised to apply the security update immediately to ensure that access control policies are correctly enforced for all gallery content.