What is CVE-2026-16561?

CVE-2026-16561 is a high-severity vulnerability in Sunshine Photo Cart, classified under Missing Authorization. CVSS score: 7.5/10. Published 2026-08-05.

How severe is CVE-2026-16561?

High severity. CVSS v3 base score is 7.5 out of 10.

Auth bypass in Sunshine Photo Cart

CVE-2026-16561

The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to retrieve the comments of images belonging to private, password-protected or otherw…

Vulnerability class: Broken Access Control

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Unknown Sunshine Photo Cart — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-16561?: CVE-2026-16561 is a high-severity vulnerability in Sunshine Photo Cart, classified under Missing Authorization. CVSS score: 7.5/10. Published 2026-08-05.
How severe is CVE-2026-16561?: High severity. CVSS v3 base score is 7.5 out of 10.