CVE-2022-23061: Shopizer

Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days.

In Shopizer versions 2.0 to 2.17.0 a regular admin can permanently delete a superadmin (although this cannot happen according to the documentation) via Insecure Direct Object Reference (IDOR) vulnerability.

Affected products

• Shopizer Shopizer: from 2.0, up to and including 2.17.0

Published 2022-05-01. Last modified 2026-06-17.