CVE-2026-47741
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
In Shopper, a headless e-commerce admin panel prior to version 2.8.0, the CreateOrderFromCartAction::execute function created the order before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied while the counter blocked at the limit. The merchant had no signal of over-redemption.
Risk Assessment
The organization may suffer financial losses due to excessive discount usage, as well as loss of customer trust and accounting issues.
Recommendation
Immediately update Shopper to version 2.8.0 or later, which contains the fix.
Other vulnerabilities in Shopper
See all- CVE-2026-47744Critical
Shopper, a Headless e-commerce Admin Panel prior to 2.8.0, contains two authorization defects in team settings. These allow any authenticated user to take over the RBAC system, create new roles, delete other users (including administrators), and escalate privileges to full panel administrator.
- CVE-2026-47743High
In the Shopper admin panel (headless e-commerce) prior to version 2.8.0, three related defects were found: missing Locked attribute on Eloquent model identifiers in Livewire components allowed data tampering, plaintext password transmission via a hidden form field led to sensitive data disclosure, and the product barcode field was rendered without proper escaping, enabling persistent XSS.
- CVE-2026-47745Medium
Shopper before version 2.8.0 does not check permissions for enable/disable, edit, and delete actions in admin tables for PaymentMethods, Currencies, and Carriers. A low-privilege user can disable payment methods, change the default currency, or disable carriers.
- CVE-2026-47742Medium
Shopper before version 2.8.0 has a vulnerability in Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files), where the store() method lacks authorization. Any authenticated user can modify prices, stock, SEO metadata, shipping dimensions, and attachments of any product.
- CVE-2026-47740High
Shopper, a Headless e-commerce Admin Panel, prior to version 2.8.0 contains a vulnerability where multiple Filament actions on order details and shipment tables could be called by an authenticated low-privilege user without the required permission to mutate orders. Actions like cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission instead of the required edit_orders. capturePayment could trigger actual PSP capture (real funds movement). A user with read access could alter the lifecycle of every order and trigger real-world payment captures.
Original NVD description (English source)
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0.