CVE-2026-16561 is an IDOR vulnerability in Sunshine Photo Cart — a WordPress plugin popular with wedding and event photographers. The flaw is in an AJAX endpoint that retrieves image comments without verifying the user has legitimate access to the protected gallery. Any unauthenticated visitor can query comment data for any image by manipulating the image ID parameter.
The CVSS 7.5 score captures the technical severity accurately but badly undersells the real-world exposure. Sunshine Photo Cart serves a specific vertical: clients sharing deeply personal visual documentation of major life events — weddings, family milestones, memorials — through password-protected galleries. The comments being exposed aren't generic blog commentary. They include exchanges between photographers and clients about which images a bride finds most flattering, family logistics coordination, or emotionally charged responses to photos never meant for public consumption. An attacker querying this endpoint learns exactly which individuals have something to hide and who might pay to suppress it — this is a targeting signal for social engineering or doxxing campaigns, not merely exposed data.
Critically, the exploitation likely leaves no server-side trace. Unlike a database breach, an IDOR exploit of a comments endpoint may generate no anomalous logs. A bride has no independent way to know her private gallery comments were accessed unless the attacker publishes them. This creates a zero-evidence exploit scenario where harm exists regardless of whether anyone realizes it.
For defenders: verify the plugin version and apply any available update. If you maintain this plugin, implement logging for all comment retrieval events — this is the only mechanism that enables victim notification. For organizations using this plugin: assume comments were potentially accessed and consider alerting any clients who left private commentary on galleries.