Sunshine Photo Cart < 3.0 - Insecure Direct Object Reference to Order Manipulation

2023-11-2300:00:00

wpscan.com

wordpress

sunshine photo cart

insecure direct object reference

order manipulation

7.1 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.0%

JSON

Description The Sunshine Photo Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.9.25 due to missing validation on a user-controlled key. This can allow unauthenticated attackers to manipulate orders that do not belong to them.