In short
- CVE-2026-47745 is a MEDIUM (CVSS 6.5) vulnerability affecting shopper/framework.
- Chance of exploitation in the next 30 days (EPSS): 0.22%, higher than 12.7% of all vulnerabilities.
- Fix: update to 2.8.0 or later.
Description
Impact
The admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could:
- Disable every payment method on the store, blocking checkout.
- Disable or alter the default currency, changing displayed prices and the exchange rate basis.
- Disable carriers, breaking shipping rate computation at checkout.
The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user.
Patches
Fixed in v2.8.0. Each toggle and per-record action now requires its matching permission (edit_payment_methods, edit_currencies, edit_carriers).
Upgrade via:
composer require shopper/admin:^2.8
Workarounds
None. Upgrade to v2.8.0.
NVD description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.
More vulnerabilities in shopper/framework
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free