Medium severity · published May 29, 2026
CVE-2026-47742
Shopper: Missing authorization on Product admin Livewire sub-form components
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SH
shopper · shopperlabs
< 2.8.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47742
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47742
github.com
https://github.com/shopperlabs/shopper/pull/511
github.com
https://github.com/shopperlabs/shopper/security/advisories/GHSA-h4mp-g9c6-xwph
More from shopper
9.9
CVE-2026-47744
Shopper: Authorization bypass and RBAC privilege escalation in team settings
8.8
CVE-2026-56828
Shopper: read-only team permissions allow administrator creation and permission escalation
8.8
CVE-2026-114387
Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
8.7
CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
8.1
CVE-2026-56827
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers