Shopper CVE-2026-47745

Exploitation requires an authenticated session in the Shopper admin panel - the CVSS vector PR:L confirms a low-privilege authenticated account is sufficient. No special admin role, no specific feature flag, and no non-default configuration is needed; any panel user account qualifies. The limiting factor is that access to the Shopper admin panel itself must first be obtained, either through a legitimately provisioned low-privilege account or through credential compromise. External unauthenticated attackers cannot exploit this directly. The vulnerability is scoped to the admin panel UI and does not affect the storefront or API layers directly.

The CVSS 3.1 score of 6.5 (Medium) is derived from AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, reflecting network-reachable exploitation requiring only low-privilege authentication with no user interaction needed. Despite the medium CVSS score, the real-world business impact is disproportionately high: disabling all payment methods effectively shuts down store revenue and constitutes a functional denial-of-service to customers, even though CVSS scores Availability as None. The discrepancy arises because CVSS measures technical system availability, not business-function availability. No EPSS data was provided in the input. The vulnerability is not listed in CISA KEV and no public POC has been identified, suggesting exploitation has not been observed in the wild. The low attack complexity (AC:L) and low privilege requirement (PR:L) mean exploitation is straightforward for any insider or compromised low-privilege account. Overall, this should be treated as a high-priority internal threat despite its medium CVSS rating.

An attacker with any valid low-privilege account in the Shopper admin panel navigates to the PaymentMethods, Currencies, or Carriers admin tables. Without needing elevated permissions, they use the rendered inline toggle controls to systematically disable all active payment methods and carriers. This immediately renders the store's checkout non-functional for all customers, constituting a targeted business disruption that may go undetected until customer complaints surface.