Shopper EUVD-2026-114510

Requires an authenticated Shopper admin-panel account that holds the edit_products permission (the content-editor role) but lacks delete_product_variants; the attacker must reach the Livewire endpoint backing /shopper/products/{id}/edit to obtain the signed component state and then call callTableAction('delete',...) or callTableBulkAction('delete',...). The condition is created by Shopper's default seeded permission model, which separates edit_products from delete_product_variants - the flaw is that the parent Edit page only gates on edit_products while the Variants component's delete actions check nothing. Limiting factors: exploitation is impossible without a valid staff login carrying edit_products (no anonymous/unauthenticated path), it affects admin-panel users rather than storefront visitors, and the destructive impact is maximized specifically on ProductType::Variant products; versions 2.10.0 and later enforce delete_product_variants and are not exploitable.

This is a genuine but bounded access-control flaw (CWE-285/CWE-862, missing server-side authorization). The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1) is internally consistent with the evidence: the Variants Livewire component exposes DeleteAction/DeleteBulkAction over the network with no authorize() call, and exploitation requires an authenticated account (PR:L), so the high score is driven entirely by integrity and availability impact, not by remote unauthenticated reach. The real-world risk is tempered by the privilege requirement: the attacker must already hold a valid staff account with the edit_products permission (a content-editor role), so this is a privilege-boundary violation within the admin panel rather than an external breach - a malicious or compromised low-tier staff account, not an anonymous internet attacker. No EPSS score is supplied and the CVE is not listed in CISA KEV, so there is no signal of widespread or active exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency). The only exploitation artifact is a Pest unit test embedded in the GHSA advisory demonstrating the deletion against Shopper's own test harness - this is a public PoC reference, not verified working exploit code against a live deployment. Net: a real authorization-boundary bug worth patching on the stated this_week cadence, but not a drop-everything internet-facing emergency given the authenticated-insider precondition and absence of KEV/EPSS exploitation signals.

A disgruntled or compromised content-editor staff account - holding only edit_products and deliberately NOT granted delete_product_variants - opens /shopper/products/{id}/edit to obtain the signed Livewire snapshot for the Variants component, then issues callTableAction('delete', ...) or callTableBulkAction('delete', ...) against the Livewire endpoint to permanently delete one or many product variants. For ProductType::Variant products this wipes the sellable catalogue, breaking storefront product pages, cart, and checkout. A public PoC reference exists in the GHSA advisory (a Pest test); it is not verified as working exploit code against a production instance.