PT-2026-44942 · Shopper · Shopper

Baradika · CVE-2026-47741 · Published 2026-05-18 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.8.0

Description A race condition exists in the CreateOrderFromCartAction::execute() function. The system creates an order row before verifying and incrementing the total use counter of a discount. Under high concurrent checkout pressure, such as flash sales or viral coupons, the global usage limit can be exceeded. This allows orders to be committed with discounts fully applied to the price amount even after the counter reaches the usage limit, without notifying the merchant of the over-redemption.

Recommendations Update to version 2.8.0.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-47741

GHSA-9RH9-HF3W-9FGG

Affected Products

Shopper

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47741.json · Exploit
• 🔥 https://github.com/shopperlabs/shopper/issues/510 · Exploit
• https://osv.dev/vulnerability/CVE-2026-47741 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9rh9-hf3w-9fgg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47741 · Security Note
• https://github.com/shopperlabs/shopper/pull/511 · Note
• https://github.com/shopperlabs/shopper/security/advisories/GHSA-9rh9-hf3w-9fgg · Note
• https://github.com/shopperlabs/shopper · Note
• https://github.com/shopperlabs/shopper/commit/fcd0c5920588702df5b874f432b1042abd77a50b · Note
• https://github.com/shopperlabs/shopper/releases/tag/v2.8.0 · Note
• https://twitter.com/infoflowcloud/status/2060471454777393338 · Twitter Post
• https://t.me/cveNotify/211274 · Telegram Post
• https://twitter.com/CVEnew/status/2060470693632803186 · Twitter Post