Shopper
Monthly
Stored cross-site scripting in the Shopper headless e-commerce admin panel (2.0.0 up to but not including 2.10.1, plus 3.0.0-beta.1 and beta.2) lets authenticated back-office staff who hold only a content-upload permission such as edit_products or add_brands plant HTML or SVG media that executes in an administrator's session when that administrator opens the file. Because the media is served inline from the same origin at /storage/ with no Content-Disposition or Content-Security-Policy, and because the CreateTeamMember store() flow trusts a client-supplied role_id, the injected script can mint a persistent attacker-controlled administrator account with access to customer data, orders, settings and user/role management. Exploitation requires two parties (a content editor who can upload plus an administrator who opens the file), since direct account creation by the low-privileged uploader is blocked by the access_setting check; the flaw is fixed in 2.10.1 and 3.0.0-beta.3, and the upstream GHSA advisory documents a proof-of-concept chain, but no CISA KEV listing appears in the provided data.
Permanent deletion of product variants in Shopper's admin panel is possible for any authenticated staff member who holds edit_products but not delete_product_variants in versions before 2.10.0, because the Variants Livewire component's single and bulk Filament delete actions perform no server-side authorization check (CWE-285/CWE-862). The parent product edit page gates only on edit_products, so a user can load /shopper/products/{id}/edit, obtain the signed component state, and invoke callTableAction('delete', ...) or callTableBulkAction('delete', ...) against the Livewire endpoint; impact is greatest on ProductType::Variant products, where the sellable catalogue and the storefront product pages, cart and checkout can break. Shopper 2.10.0 adds ->authorize('delete_product_variants') to both actions; a public proof-of-concept test is referenced in the advisory but is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation is reported.
Privilege escalation in Shopper 2.0.0 through 2.5.x allows an authenticated admin-panel user who holds only the access_dashboard permission to create new administrator accounts or grant elevated permissions by invoking CreateTeamMember::store() or Permissions::togglePermission() directly through /livewire/update. The missing server-side authorization checks make this a genuine privilege-escalation path for low-privilege back-office accounts; upgrading to 2.6.0 adds the required authorize() guards. No public exploit identified at time of analysis, and exploitation requires a valid authenticated session rather than anonymous internet access.
Authorization bypass in Shopperlabs Shopper headless e-commerce admin panel prior to 2.8.0 allows authenticated low-privilege users with read-only order permissions to mutate every order in the panel and trigger real Payment Service Provider captures via Filament admin actions. The flaw spans multiple Livewire components beyond orders - including product sub-forms, team settings, and RBAC management - enabling privilege escalation up to role creation and user deletion. No public exploit identified at time of analysis, but a detailed GitHub Security Advisory and patch diff are public.
Privilege escalation in Shopper headless e-commerce admin panel prior to version 2.8.0 allows any low-privilege authenticated panel user to seize full administrator control by chaining two distinct broken-authorization defects in the team settings module. By combining an unprotected Settings/Team/Index mount with a RolePermission write path that only checks the read-only view_users permission, an attacker can mint new roles, grant themselves manage_users and edit_orders, and delete legitimate administrators. No public exploit identified at time of analysis, but the bugs are straightforward to weaponize once panel credentials are obtained.
Shopper versions prior to 2.10.1 expose administrator and staff profile records to low-privileged admin-panel users through an insecure direct object reference in the customer detail route `/cpanel/customers/{user}/show`. Any account holding `access_dashboard` and `read_customers` can substitute an arbitrary user ID and receive profile data for accounts that the separate team-management interface protects behind the stronger `view_users` permission; differing 200/403/404 responses also permit user-ID enumeration, and if the same role holds `delete_customers` the `anonymizeAction()` may operate on the unrestricted loaded user model. Exploitation requires a valid authenticated staff session (PR:L) and same-table staff/customer accounts, and the vendor advisory ships a step-by-step proof-of-concept reproduction; the trigger is an ordinary authenticated request with a modified URL path segment rather than any special product configuration.
Discount over-redemption via race condition in Shopper (shopperlabs/shopper prior to v2.8.0) allows concurrent unauthenticated checkout requests to bypass a coupon's global usage_limit, resulting in committed orders carrying unauthorized discounts the merchant never intended to grant. The CreateOrderFromCartAction::execute method created the Order database row before atomically reserving the discount slot, opening a classic TOCTOU window that becomes reliably exploitable under the high-concurrency traffic of flash sales or Black Friday events. A compounding bug rendered usage_limit_per_user entirely non-functional in all pre-2.8.0 versions - the underlying counter was never incremented anywhere in the codebase - meaning per-user caps provided zero protection regardless of a customer's redemption history. No public exploit identified at time of analysis; this CVE is not listed in CISA KEV.
Privilege escalation in shopperlabs/shopper prior to 2.8.0 allows any authenticated admin panel user - regardless of assigned role - to mutate pricing, inventory, SEO metadata, shipping dimensions, and attached media for any product by exploiting missing authorization on Livewire sub-form component store() methods. Because the product ID was accepted as an unlocked public Livewire property, attackers could additionally target arbitrary products by tampering with the wire payload from the client side, not just products they otherwise interact with. No active exploitation confirmed (not in CISA KEV), and no standalone POC code has been published, though the remediation PR diff is publicly available.
Missing authorization enforcement in the Shopper headless e-commerce admin panel (all versions prior to 2.8.0) allows any authenticated low-privilege panel user to disable payment methods, alter the default currency, or disable carriers - actions that should be restricted by per-action permissions. The business impact is severe: a malicious or compromised low-privilege account can cause a complete denial of checkout and undermine pricing integrity across the store. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the Shopper headless e-commerce admin panel (2.0.0 up to but not including 2.10.1, plus 3.0.0-beta.1 and beta.2) lets authenticated back-office staff who hold only a content-upload permission such as edit_products or add_brands plant HTML or SVG media that executes in an administrator's session when that administrator opens the file. Because the media is served inline from the same origin at /storage/ with no Content-Disposition or Content-Security-Policy, and because the CreateTeamMember store() flow trusts a client-supplied role_id, the injected script can mint a persistent attacker-controlled administrator account with access to customer data, orders, settings and user/role management. Exploitation requires two parties (a content editor who can upload plus an administrator who opens the file), since direct account creation by the low-privileged uploader is blocked by the access_setting check; the flaw is fixed in 2.10.1 and 3.0.0-beta.3, and the upstream GHSA advisory documents a proof-of-concept chain, but no CISA KEV listing appears in the provided data.
Permanent deletion of product variants in Shopper's admin panel is possible for any authenticated staff member who holds edit_products but not delete_product_variants in versions before 2.10.0, because the Variants Livewire component's single and bulk Filament delete actions perform no server-side authorization check (CWE-285/CWE-862). The parent product edit page gates only on edit_products, so a user can load /shopper/products/{id}/edit, obtain the signed component state, and invoke callTableAction('delete', ...) or callTableBulkAction('delete', ...) against the Livewire endpoint; impact is greatest on ProductType::Variant products, where the sellable catalogue and the storefront product pages, cart and checkout can break. Shopper 2.10.0 adds ->authorize('delete_product_variants') to both actions; a public proof-of-concept test is referenced in the advisory but is not verified as working exploit code, and no CISA KEV entry or confirmed active exploitation is reported.
Privilege escalation in Shopper 2.0.0 through 2.5.x allows an authenticated admin-panel user who holds only the access_dashboard permission to create new administrator accounts or grant elevated permissions by invoking CreateTeamMember::store() or Permissions::togglePermission() directly through /livewire/update. The missing server-side authorization checks make this a genuine privilege-escalation path for low-privilege back-office accounts; upgrading to 2.6.0 adds the required authorize() guards. No public exploit identified at time of analysis, and exploitation requires a valid authenticated session rather than anonymous internet access.
Authorization bypass in Shopperlabs Shopper headless e-commerce admin panel prior to 2.8.0 allows authenticated low-privilege users with read-only order permissions to mutate every order in the panel and trigger real Payment Service Provider captures via Filament admin actions. The flaw spans multiple Livewire components beyond orders - including product sub-forms, team settings, and RBAC management - enabling privilege escalation up to role creation and user deletion. No public exploit identified at time of analysis, but a detailed GitHub Security Advisory and patch diff are public.
Privilege escalation in Shopper headless e-commerce admin panel prior to version 2.8.0 allows any low-privilege authenticated panel user to seize full administrator control by chaining two distinct broken-authorization defects in the team settings module. By combining an unprotected Settings/Team/Index mount with a RolePermission write path that only checks the read-only view_users permission, an attacker can mint new roles, grant themselves manage_users and edit_orders, and delete legitimate administrators. No public exploit identified at time of analysis, but the bugs are straightforward to weaponize once panel credentials are obtained.
Shopper versions prior to 2.10.1 expose administrator and staff profile records to low-privileged admin-panel users through an insecure direct object reference in the customer detail route `/cpanel/customers/{user}/show`. Any account holding `access_dashboard` and `read_customers` can substitute an arbitrary user ID and receive profile data for accounts that the separate team-management interface protects behind the stronger `view_users` permission; differing 200/403/404 responses also permit user-ID enumeration, and if the same role holds `delete_customers` the `anonymizeAction()` may operate on the unrestricted loaded user model. Exploitation requires a valid authenticated staff session (PR:L) and same-table staff/customer accounts, and the vendor advisory ships a step-by-step proof-of-concept reproduction; the trigger is an ordinary authenticated request with a modified URL path segment rather than any special product configuration.
Discount over-redemption via race condition in Shopper (shopperlabs/shopper prior to v2.8.0) allows concurrent unauthenticated checkout requests to bypass a coupon's global usage_limit, resulting in committed orders carrying unauthorized discounts the merchant never intended to grant. The CreateOrderFromCartAction::execute method created the Order database row before atomically reserving the discount slot, opening a classic TOCTOU window that becomes reliably exploitable under the high-concurrency traffic of flash sales or Black Friday events. A compounding bug rendered usage_limit_per_user entirely non-functional in all pre-2.8.0 versions - the underlying counter was never incremented anywhere in the codebase - meaning per-user caps provided zero protection regardless of a customer's redemption history. No public exploit identified at time of analysis; this CVE is not listed in CISA KEV.
Privilege escalation in shopperlabs/shopper prior to 2.8.0 allows any authenticated admin panel user - regardless of assigned role - to mutate pricing, inventory, SEO metadata, shipping dimensions, and attached media for any product by exploiting missing authorization on Livewire sub-form component store() methods. Because the product ID was accepted as an unlocked public Livewire property, attackers could additionally target arbitrary products by tampering with the wire payload from the client side, not just products they otherwise interact with. No active exploitation confirmed (not in CISA KEV), and no standalone POC code has been published, though the remediation PR diff is publicly available.
Missing authorization enforcement in the Shopper headless e-commerce admin panel (all versions prior to 2.8.0) allows any authenticated low-privilege panel user to disable payment methods, alter the default currency, or disable carriers - actions that should be restricted by per-action permissions. The business impact is severe: a malicious or compromised low-privilege account can cause a complete denial of checkout and undermine pricing integrity across the store. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.