CVE-2026-47742: medium-severity vulnerability in shopperlabs shopper
Shopper: Missing authorization on Product admin Livewire sub-form components
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.2%
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
shopperlabs · shopperRelated CVEs — shopperlabs shopper
In the same product, most dangerous first.
CVE-2026-56827HIGHShopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliersEPSS 0.5%CVE-2026-56829HIGHShopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock componentEPSS 0.5%CVE-2026-56825HIGHShopper: Missing authorization on product removal actions in CollectionProducts componentEPSS 0.5%CVE-2026-56828HIGHShopper: read-only team permissions allow administrator creation and permission escalationEPSS 0.4%CVE-2026-56831MEDIUMShopper: Negative discount values accepted and propagated through order calculation pipelineEPSS 0.4%CVE-2026-56830MEDIUMShopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorizationEPSS 0.4%