Shopperlabs Shopper vulnerabilities

• shopperdotcom shopper Shopper: customer detail IDOR exposes administrator and staff records CVE-2026-62991 6.5 MediumOctober 30, 2026
• shopperdotcom shopper Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation CVE-2026-62990 8.7 HighOctober 30, 2026
• shopperdotcom shopper Shopper: missing variant-delete authorization permits destructive single and bulk actions CVE-2026-62989 8.1 HighOctober 30, 2026
• shopperdotcom shopper Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components CVE-2026-114387 8.7 HighOctober 21, 2026
• shopperdotcom shopper Shopper: Missing authorization on product removal actions in CollectionProducts component CVE-2026-56825 Fix available 8.1 HighSeptember 11, 2026
• shopperdotcom shopper Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization CVE-2026-56830 Fix available 6.5 MediumSeptember 11, 2026
• shopperdotcom shopper Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component CVE-2026-56829 Fix available 8.1 HighSeptember 11, 2026
• shopperdotcom shopper Shopper: read-only team permissions allow administrator creation and permission escalation CVE-2026-56828 Fix available 8.8 HighSeptember 11, 2026
• shopperdotcom shopper Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration CVE-2026-56826 Fix available 5.4 MediumSeptember 11, 2026
• shopperdotcom shopper Shopper: Negative discount values accepted and propagated through order calculation pipeline CVE-2026-56831 Fix available 6.5 MediumSeptember 11, 2026
• shopperdotcom shopper Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers CVE-2026-56827 Fix available 8.1 HighSeptember 11, 2026
• shopperdotcom shopper Shopper: Multiple data integrity and disclosure issues in admin Livewire components CVE-2026-47743 Fix available 8.7 HighJune 5, 2026
• shopperdotcom shopper Shopper: Missing authorization on Product admin Livewire sub-form components CVE-2026-47742 Fix available 6.5 MediumMay 29, 2026
• shopperdotcom shopper Shopper: Authorization bypass and RBAC privilege escalation in team settings CVE-2026-47744 Fix available 9.9 CriticalMay 29, 2026
• shopperdotcom shopper Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables CVE-2026-47745 Fix available 6.5 MediumMay 29, 2026
• shopperdotcom shopper Shopper: Race condition on Discount.usage_limit allows silent over-redemption CVE-2026-47741 Fix available 5.9 MediumMay 18, 2026
• shopperdotcom shopper Shopper: Authorization bypass in multiple Livewire admin components CVE-2026-47740 Fix available 8.1 HighMay 18, 2026