PT-2026-44942 · Shopper · Shopper

Baradika · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-47741

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.8.0

Description A race condition exists in the CreateOrderFromCartAction::execute() function. The system creates an order row before verifying and incrementing the total use counter of a discount. Under high concurrent checkout pressure, such as flash sales or viral coupons, the global usage limit can be exceeded. This allows orders to be committed with discounts fully applied to the price amount even after the counter reaches the usage limit, without notifying the merchant of the over-redemption.

Recommendations Update to version 2.8.0.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-47741

Affected Products

Shopper

References · 6

• 🔥 https://github.com/shopperlabs/shopper/issues/510 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-47741 · Security Note
• https://github.com/shopperlabs/shopper/security/advisories/GHSA-9rh9-hf3w-9fgg · Note
• https://github.com/shopperlabs/shopper/pull/511 · Note
• https://twitter.com/CVEnew/status/2060470693632803186 · Twitter Post
• https://twitter.com/infoflowcloud/status/2060471454777393338 · Twitter Post