Sunshine Photo Cart < 3.4.12 - Subscriber Privilege Escalation

Description

The plugin is vulnerable to privilege escalation via account takeover due to the plugin not properly validating a user-supplied key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords through the password reset functionality, including administrators, and leverage that to reset the user's password and gain access to their account.