Sunshine Photo Cart Privilege Escalation Vulnerability Allowing Unauthorized Password Resets

A privilege escalation vulnerability has been identified in the Sunshine Photo Cart WordPress plugin, specifically in versions through 3.4.11. This vulnerability allows authenticated users with Subscriber-level access and above to exploit improper validation of user-supplied keys. By doing so, they can manipulate the password reset functionality to change passwords of any user, including administrators. This unauthorized password change enables attackers to gain access to the targeted accounts.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, leading to account takeovers.

Reproduction

To reproduce this vulnerability, an authenticated user with Subscriber-level access or higher can send a request to the password reset endpoint, including a user-supplied key. The lack of proper validation on the key allows the attacker to reset passwords of other users, including those with administrative privileges.

Remediation

Users are advised to update the Sunshine Photo Cart plugin to version 3.4.12 or later.