External risk intelligence

Sunshine Photo Cart PHP Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-104730

The vulnerability exists in a WordPress plugin designed for public-facing photo galleries and proofing. As a web application component that is commonly accessible to the public internet for users to view and interact with galleries, the attack surface is exposed by design in typical deployments.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in the Sunshine Photo Cart WordPress plugin that could allow unauthenticated attackers to inject PHP objects. This could lead to serious consequences like data deletion or code execution if other specific plugins or themes are also present on the site.

Unauthenticated code injection risk in a WordPress plugin.
Potentially severe impact if other themes or plugins are present.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by uploading a malicious PHP Object to the public favorites page. This object can then be deserialized when an attacker tricks a user into viewing an image in a private or non-viewable gallery. If the WordPress site also has another plugin or theme with a dangerous PHP Object (POP) chain installed, this can lead to serious consequences.

No authentication required.
Triggered by viewing images in specific galleries.
Leads to arbitrary file deletion or data retrieval.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to inject PHP objects into a WordPress site, potentially leading to severe consequences if another plugin or theme with a POP chain is present. The impact is contingent on the presence of a vulnerable POP chain, which would then enable actions such as arbitrary file deletion, sensitive data retrieval, or code execution.

WordPress photo gallery data.
Unauthenticated injection via public pages.
Arbitrary file deletion or code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Plugin owners and website administrators are likely responsible for addressing this vulnerability. The first practical step is to identify all WordPress sites utilizing the Sunshine Photo Cart plugin, confirm if any sites have a vulnerable version installed, and assess if other plugins or themes are present that could introduce a POP chain, thereby increasing the risk of exploitation.

Plugin owners should manage the remediation.
Verify presence of vulnerable plugin versions.
Assess for vulnerable POP chain conditions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sunshine Photo Cart plugin?

Sunshine Photo Cart is a WordPress plugin used by photographers to create client galleries and proofing pages. It allows visitors to browse, select, and interact with professional images directly on a photographer's website. Because it is designed to manage public-facing media, it is typically installed on web servers reachable by anyone on the internet.

What does PHP Object Injection mean in CVE-2026-104730?

This is a security weakness categorized as CWE-502 (Deserialization of Untrusted Data). It happens when an application takes user-provided data and reconstructs it into a complex PHP object without proper validation. In this case, the vulnerability itself does not immediately compromise the site, but it creates a doorway that attackers can use to pass malicious objects into the application.

How is this vulnerability triggered?

An attacker must send a malicious PHP object via the public favorites page. The vulnerability is triggered when this object is deserialized, which happens when viewing an image in a private or restricted gallery. Importantly, the vulnerability does not trigger on its own; it requires the presence of a 'POP chain'—a specific sequence of code found in other plugins or themes—to perform harmful actions like deleting files.

Do I need to worry if my site uses Sunshine Photo Cart?

According to Halo Surface Signal, this plugin is designed to be internet-facing, meaning the attack surface is exposed by default. Because the plugin is commonly used on public websites, any site running version 3.7.4 or earlier is potentially reachable by an unauthenticated attacker. You should treat this as a relevant security concern if your site is publicly accessible.

What should I do first to address this issue?

Start by auditing your WordPress installation to confirm if you are running the affected version of the plugin. Next, check your environment for other installed themes or plugins that might contain POP chains, as these are necessary to weaponize this vulnerability. Prioritize updating the plugin or removing it if an update is not available to eliminate the injection path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.