{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/sunshine-photo-cart--client-photo-gallery--photo-proofing-for-photographers--3.7.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wordpress:sunshine_photo_cart_client_photo_gallery_photo_proofing_for_photographers:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-104730"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Sunshine Photo Cart – Client Photo Gallery \u0026 Photo Proofing for Photographers (\u003c= 3.7.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","wordpress","injection"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Sunshine Photo Cart - Client Photo Gallery \u0026amp; Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection (CVE-2026-104730) in all versions up to and including 3.7.4. The vulnerability arises from the insecure deserialization of untrusted input. While the plugin itself does not contain a Property-Oriented Programming (POP) chain required for full exploitation, the vulnerability allows unauthenticated attackers to supply a malicious serialized object via the public favorites page.\u003c/p\u003e\n\u003cp\u003eIf the WordPress environment contains other plugins or themes that include a POP chain, this vulnerability can be successfully leveraged to achieve remote code execution, perform arbitrary file deletions, or retrieve sensitive data. Attackers can trigger the deserialization process by interacting with specific image viewing endpoints associated with non-viewable or private galleries. This vulnerability represents a significant risk for WordPress sites hosting multiple plugins where cross-plugin POP chain exploitation is possible.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this vulnerability is contingent upon the existence of secondary POP chains within the target's WordPress installation. If such a chain exists, the vulnerability allows for unauthenticated remote code execution, unauthorized access to sensitive data, and potential system compromise. Given the prevalence of plugin-heavy WordPress environments, many installations are at risk of being exploited if a viable gadget chain is discovered in commonly deployed software.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Sunshine Photo Cart - Client Photo Gallery \u0026amp; Photo Proofing for Photographers plugin to the latest available version (beyond 3.7.4) to address the insecure deserialization logic.\u003c/li\u003e\n\u003cli\u003eAudit installed WordPress plugins and themes for known POP chain gadgets, particularly those known to be utilized in object injection attacks.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to block POST requests containing serialized PHP object strings (e.g., 'O:[0-9]+:\u0026quot;') directed at public-facing plugin endpoints until the site can be patched.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for high volumes of 403 or 500 errors originating from unauthenticated users accessing private or non-viewable gallery images, which may indicate exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T08:24:57Z","date_published":"2026-10-16T08:24:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-sunshine-photo-cart-injection/","summary":"The Sunshine Photo Cart plugin for WordPress is vulnerable to unauthenticated PHP object injection in versions up to 3.7.4, which can be leveraged for RCE if secondary plugins provide a viable POP chain.","title":"PHP Object Injection in Sunshine Photo Cart WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-sunshine-photo-cart-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Sunshine Photo Cart – Client Photo Gallery \u0026 Photo Proofing for Photographers (\u003c= 3.7.4)","version":"https://jsonfeed.org/version/1.1"}