CVE-2026-85037: Unknown Sunshine Photo Cart

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.

Affected products

• Unknown Sunshine Photo Cart: before 3.7 (fixed in 3.7)

Published 2026-09-09. Last modified 2026-09-09.