CVE-2026-85037 Sunshine Photo Cart < 3.7 - Unauthenticated Price Manipulation via IDOR
Unauthenticated attackers can manipulate cart prices to purchase items at lower costs, causing financial loss for site owners.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85037?
CVE-2026-85037 is a medium-severity vulnerability in Unknown Sunshine Photo Cart, published on 9 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is added to the cart, allowing unauthenticated users to buy items at a lower price defined elsewhere on the site and complete an order at that price, resulting in financial loss for the site owner.
Weakness: CWE-639
Which versions are affected by CVE-2026-85037?
How do I fix CVE-2026-85037?
No fix has been published for CVE-2026-85037 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-85037 being exploited?
There is no known exploitation of CVE-2026-85037 in the wild and no public exploit code.
Sources
Also known as GHSA-6v37-8246-gmfc.