CVE-2025-67973: 
WordPress vulnerability analysis and mitigation

CVE-2025-67973 is a Missing Authorization (Broken Access Control) vulnerability in the Sunshine Photo Cart WordPress plugin by sunshinephotocart. It affects all versions of the plugin up to and including 3.5.6.2, allowing unauthenticated network-based attackers to exploit incorrectly configured access control security levels. The vulnerability was published on February 20, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before granting access to certain functionality or data. The attack vector is network-based, requires no authentication, no user interaction, and has low attack complexity, making it straightforward to exploit remotely. The flaw falls under the broader category of broken access control, where restricted plugin endpoints or actions can be accessed by unauthenticated or unauthorized users due to absent or improperly enforced capability checks (Feedly, Patchstack).

Successful exploitation results in low confidentiality impact and low availability impact, with no integrity impact, as reflected in the CVSS scoring. An unauthenticated attacker could access restricted plugin data or functionality — such as order information, customer details, or administrative features — without proper authorization. While the impact is limited in scope (no privilege escalation or data modification is indicated), exposure of sensitive e-commerce or customer data on WordPress sites using this plugin remains a concern (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-67973. The EPSS score is very low at approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly).

Users should update the Sunshine Photo Cart WordPress plugin to a version beyond 3.5.6.2, which is the last confirmed vulnerable release. Site administrators should check the WordPress plugin repository or the vendor's official channel for a patched release and apply it promptly. As a temporary workaround, consider disabling the plugin until a patch is available, or restricting access to the WordPress site's plugin-related endpoints via web application firewall (WAF) rules (Patchstack, Feedly).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report covering the period of January 26 to February 1, 2026, indicating routine tracking by the WordPress security community (Wordfence). No significant vendor statements, researcher commentary, or broader media coverage has been identified beyond standard vulnerability database listings.