WordPress Sunshine Photo Cart Plugin PHP Object Injection Vulnerability

The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4, via deserialization of untrusted input.

This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, so the vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site.

• Affected versions: all versions up to and including 3.7.4.
• Attackers can store the malicious payload unauthenticated via the public favorites page.
• Deserialization is triggered by viewing any image in a non-viewable or private gallery.
• If a POP chain is present via an additional plugin or theme, it may allow deleting arbitrary files, retrieving sensitive data, or executing code depending on the POP chain.