CVE-2026-47745: Shopperlabs Shopper

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.

Affected products

• Shopperlabs Shopper: before 2.8.0 (fixed in 2.8.0)

Published 2026-05-29. Last modified 2026-07-22.