PT-2026-44943 · Shopper · Shopper

Baradika · Published 2026-05-29 · Updated 2026-06-05 · CVE-2026-47742

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.8.0

Description Sub-form Livewire components within the product editor—specifically those handling Edit, Inventory, Seo, Shipping, and Files—lack authorization on their store() method. This allows any authenticated panel user, regardless of their assigned role, to modify product pricing, stock, SEO metadata, shipping dimensions, and attached media without possessing the edit products permission. Additionally, these components accept the product ID as a public Livewire property that is not protected by the #[Locked] attribute, enabling an attacker to target arbitrary products by manipulating the wire payload from the client side.

Recommendations Update to version 2.8.0.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-47742

GHSA-H4MP-G9C6-XWPH

Affected Products

Shopper

References · 7

• https://osv.dev/vulnerability/GHSA-h4mp-g9c6-xwph · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47742 · Security Note
• https://github.com/shopperlabs/shopper/security/advisories/GHSA-h4mp-g9c6-xwph · Note
• https://github.com/shopperlabs/shopper · Note
• https://github.com/shopperlabs/shopper/pull/511 · Note
• https://twitter.com/CVEnew/status/2060470694790500836 · Twitter Post
• https://twitter.com/infoflowcloud/status/2060471471315517581 · Twitter Post