Sunshine Photo Cart < 3.2.2 - Missing Authorization

Description

The Sunshine Photo Cart plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the sunshine_add_to_favorites() function in versions up to, and including, 3.2.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to favorite images in galleries a user does not have access to.