CVE-2025-31084 is a Critical severity (CVSS 9.8) PHP object injection flaw in the Sunshine Photo Cart WordPress plugin, versions up to and including 3.4.10. Patchstack lists 3.4.11 as the patched version and an unauthenticated required privilege. Update the plugin promptly.
What's affected
The record covers Sunshine Photo Cart (slug sunshine-photo-cart) from sunshinephotocart, in all versions up to and including 3.4.10. The NVD description names the weakness as deserialization of untrusted data, which allows object injection.
The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network reachable, low complexity, no privileges, no user interaction, and high impact on all three security properties.
Patchstack lists the required privilege as unauthenticated and the fix as 3.4.11. The record does not flag the CVE as exploited in the wild, and it is not in CISA KEV. Patchstack, as the advisory source, does say that vulnerabilities of this severity tend to attract mass scanning, which is a reason to move quickly.
How to check if you're exposed
Check the version with WP-CLI:
wp plugin get sunshine-photo-cart --fields=name,version,status
Or read it from the Plugins page in the WordPress admin. Anything at 3.4.10 or lower is affected.
Photo and store sites often run on a separate staging or client copy that nobody remembers. List plugins across every WordPress install you manage, including multisite networks, and include sites you host for others.
The advisory does not describe how to confirm a past compromise. If the site was exposed on a vulnerable version for some time, check administrator accounts, recently changed files and unexpected scheduled tasks, and compare the plugin directory with a fresh download of the plugin.
What to do now
- Update Sunshine Photo Cart to 3.4.11 or later, or run
wp plugin update sunshine-photo-cart. - If you cannot update now, deactivate the plugin, or put the store behind a firewall rule that blocks unauthenticated requests to its endpoints.
- Compare the plugin folder and
wp-content/uploadsagainst a clean copy and look for PHP files that should not be there. - Review administrator users and scheduled events for anything you did not create.
- If the store handles customer data, follow your own breach assessment process if you find signs of abuse.
Why it matters
PHP serializes objects to strings so they can be stored or sent. When an application turns such a string back into an object using data from a visitor, the visitor chooses which object gets built. The weakness is CWE-502. If any class loaded in the application has code that runs when an object is created or destroyed, a crafted object can trigger that code in ways the developers did not plan.
That is why the scoring is so high even though the advisory says little about the mechanics. The standard fix is to stop deserializing untrusted input, or to switch to a data only format such as JSON and validate it. For plugin users, the lesson is simple: a store plugin sits on the public internet, takes input from strangers and often has access to customer records, so it deserves the shortest patch window on the site.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is PHP object injection in simple terms?
It is a flaw where the application rebuilds an object from data supplied by a visitor. The visitor can pick the object type and its properties, which can trigger unintended behavior.
Is 3.4.11 the only fix?
Patchstack lists 3.4.11 as the patched version. Check the plugin changelog for later releases and install the newest stable one.
Sources
Last reviewed: 19 October 2026.
