CVE-2024-50463: 
WordPress vulnerability analysis and mitigation

URL Redirection to Untrusted Site ('Open Redirect') vulnerability was discovered in WP Sunshine Sunshine Photo Cart plugin affecting versions through 3.2.9. The vulnerability was disclosed on October 24, 2024, and received the identifier CVE-2024-50463. The issue was reported by Muhamad Agil Fachrian and affects the WordPress plugin Sunshine Photo Cart (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N according to NVD's assessment. Patchstack assigned a slightly lower CVSS score of 4.7 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N. The vulnerability is classified as CWE-601: URL Redirection to Untrusted Site ('Open Redirect') (NVD).

The vulnerability could allow a malicious actor to redirect users from one site to another due to the redirect URL not being validated. Users could be tricked into visiting a legitimate site only to be redirected to a malicious site, potentially leading to phishing incidents (Patchstack).

The vulnerability has been fixed in version 3.2.11 of the Sunshine Photo Cart plugin. Users are advised to update to version 3.2.11 or later to remove the vulnerability (Patchstack).