CVE-2022-40692 WordPress Sunshine Photo Cart Plugin <= 2.9.13 is vulnerable to Cross Site Request Forgery (CSRF)
An attacker can trick authenticated users into performing unintended actions in the Sunshine Photo Cart plugin, potentially modifying data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-40692?
CVE-2022-40692 is a medium-severity vulnerability in WP Sunshine Sunshine Photo Cart, published on 2 Feb 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions.
Weakness: CWE-352
Which versions are affected by CVE-2022-40692?
It affects 1 product.
Products include Sunshinephotocart Sunshine Photo Cart.
How do I fix CVE-2022-40692?
No fix has been published for CVE-2022-40692 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-40692 being exploited?
There is no known exploitation of CVE-2022-40692 in the wild and no public exploit code.
Other vulnerabilities in WP Sunshine Sunshine Photo Cart
- CVE-2025-31084 WordPress Sunshine Photo Cart plugin <= 3.4.10 - PHP Object Injection Vulnerability
- CVE-2025-5482 Sunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege Escalation
- CVE-2024-47314 WordPress Sunshine Photo Cart plugin <= 3.2.8 - Broken Access Control vulnerability
- CVE-2024-43971 WordPress Sunshine Photo Cart plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30194 WordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
Sources
Also known as GHSA-9v2q-q88j-mr44.