Unauthenticated attackers can inject PHP objects into the Sunshine Photo Cart WordPress plugin up to version 3.7.4, and Wordfence rates the flaw CVSS 9.8 (Critical).
What Is It
CVE-2026-104730 is a PHP Object Injection flaw (CWE-502, deserialization of untrusted data) in the Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress. The plugin deserializes untrusted input, so an attacker can inject a PHP object without logging in.
According to the NVD description, an attacker stores the malicious payload through the plugin's public favorites page. Deserialization then happens when someone views any image in a non-viewable or private gallery. Wordfence reported the flaw, and NVD published it on 2026-10-16. Its NVD status is "Received."
Why It Matters
The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means the attack works over the network, is easy to carry out, and needs no login or user interaction. The impact on confidentiality, integrity and availability is rated High.
There is an important limit. No POP chain is currently known in the vulnerable plugin itself. Based on what is known now, the flaw's impact depends on whether another plugin or theme on the site supplies one. If one is present, the attacker may be able to delete arbitrary files, retrieve sensitive data, or execute code, depending on that chain. WordPress sites often run many third-party plugins and themes, so site owners should not assume they are safe because of this limit.
As of publication (2026-10-16), CVE-2026-104730 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV does not confirm active exploitation at this time. CISA updates the catalog regularly, so readers should check it for the current status.
What's Vulnerable
- Vendor: sunshinephotocart
- Product: Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers (WordPress plugin)
- Affected versions: All versions up to and including 3.7.4
The source references point to code in class-frontend.php, class-image.php and class-session.php in the plugin's 3.7.3 tag.
Patch Status
The supplied records do not name a fixed version. The NVD references include a WordPress plugin changeset, but the data does not say which release contains the fix. Site owners should:
- Check which Sunshine Photo Cart version they run and update to a release later than 3.7.4 once the vendor confirms it fixes the flaw.
- Check the Wordfence advisory for confirmed fix details.
- If no fixed release is available, consider disabling the plugin. Also review other installed plugins and themes. No POP chain is known in the plugin itself, so a chain supplied by other code on the site is the most likely way to exploit this flaw.
There is no CISA KEV required action for this CVE because it was not listed in the KEV catalog as of publication. If CISA adds it later, a required action and due date will be published with that entry.