Authentication vulnerability in Sunshine Photo Cart: Free Client Photo Galleries for Photographers 3.4.11

The Sunshine Photo Cart plugin for WordPress, which allows photographers to create free client photo galleries, has a security flaw that could allow attackers to gain unauthorized access to user accounts. This is because the plugin does not properly check the key provided by the user. This means that attackers with at least Subscriber-level access could change any user’s password, including administrators, by using the password reset feature. They could then use this to access the user’s account without their permission.