CVE-2026-42776

MediumCVSS 6.3/10Last modified Jul 24, 2026

Description

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Sunshine Photo Cart: from n/a through 3.6.7.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
WP SunshineSunshine Photo Cart<= 3.6.7

References

Timeline

Published
May 25, 2026
Last modified
Jul 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-427778.1Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.CVE-2026-427789.8The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: The fix for CVE-202CVE-2026-427799.8The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. Here was the original issue description: Apache MINA'CVE-2026-42786.4The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sdc_menu' shortcode in all versions uCVE-2026-427804.9A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwriteCVE-2026-427816.5When embedded Packet Velocity Acceleration (ePVA) acceleration is configured, undisclosed local ethernet traffic can cause an increase in ePCVE-2026-427827.2Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for ImplementationsCVE-2026-427847.4A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, CVE-2026-427857.2OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell coCVE-2026-427868.7Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memCVE-2026-427886.9Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated memory exhaustion via oversized CVE-2026-427894.8Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate
CVE-2026-42776: Medium severity, CVSS 6.3 | Vulnix