PT-2025-23780 · WordPress · Sunshine Photo Cart
Audrey François
+1
·
Published
2025-06-04
·
Updated
2025-07-11
·
CVE-2025-5482
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
The Sunshine Photo Cart: Free Client Photo Galleries for Photographers plugin for WordPress versions up to, and including, 3.4.11
Description
The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user-supplied key. This allows authenticated attackers with Subscriber-level access and above to change arbitrary users' passwords, including administrators, through the password reset functionality. This can be leveraged to reset the user's password and gain access to their account.
Recommendations
For versions up to, and including, 3.4.11, update to a version that properly validates user-supplied keys to prevent privilege escalation.
As a temporary workaround, consider restricting access to the password reset functionality to minimize the risk of exploitation.
Restrict access to the plugin's settings and functionality to trusted users only, to reduce the potential for account takeover.
Fix
LPE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sunshine Photo Cart