All vulnerabilities
CVE-2026-56826GHSA-f7h9-qv4x-9x57

Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

shopperlabs shopperPackagistLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 17 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.9.2Fixed versionGitHub
Published13 Oct 2026Updated 17 Oct 2026CVE List

What fixes it

  • 2.9.2shopper/framework, composerGitHubcomposer require "shopper/framework:^2.9.2"
  • 2.9.2shopper/framework, PackagistOSVcomposer require "shopper/framework:^2.9.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.

Text from CVE List

Affected versions 44

  • shopperaffected: >= 2.0.0, < 2.9.2CVE List
  • shopper/framework, composer>= 2.0.0, < 2.9.2GitHub
  • shopper/framework, Packagistfrom 2.0.0, fixed in 2.9.2OSV
  • shopper/framework, Packagistv2.0.0OSV
  • shopper/framework, Packagistv2.0.1OSV
  • shopper/framework, Packagistv2.0.2OSV
  • shopper/framework, Packagistv2.0.3OSV
  • shopper/framework, Packagistv2.1.1OSV
  • shopper/framework, Packagistv2.1.2OSV
  • shopper/framework, Packagistv2.1.3OSV
  • shopper/framework, Packagistv2.1.4OSV
  • shopper/framework, Packagistv2.1.5OSV
  • shopper/framework, Packagistv2.1.6OSV
  • shopper/framework, Packagistv2.2OSV
  • shopper/framework, Packagistv2.2.1OSV
  • shopper/framework, Packagistv2.2.2OSV
  • shopper/framework, Packagistv2.2.3OSV
  • shopper/framework, Packagistv2.2.4OSV
  • shopper/framework, Packagistv2.2.5OSV
  • shopper/framework, Packagistv2.2.6OSV
  • shopper/framework, Packagistv2.2.7OSV
  • shopper/framework, Packagistv2.3OSV
  • shopper/framework, Packagistv2.3.1OSV
  • shopper/framework, Packagistv2.3.2OSV
  • shopper/framework, Packagistv2.3.3OSV
  • shopper/framework, Packagistv2.4.0OSV
  • shopper/framework, Packagistv2.4.1OSV
  • shopper/framework, Packagistv2.4.2OSV
  • shopper/framework, Packagistv2.4.3OSV
  • shopper/framework, Packagistv2.5.0OSV
  • shopper/framework, Packagistv2.5.1OSV
  • shopper/framework, Packagistv2.6.0OSV
  • shopper/framework, Packagistv2.6.1OSV
  • shopper/framework, Packagistv2.6.2OSV
  • shopper/framework, Packagistv2.6.3OSV
  • shopper/framework, Packagistv2.6.4OSV
  • shopper/framework, Packagistv2.7.0OSV
  • shopper/framework, Packagistv2.7.1OSV
  • shopper/framework, Packagistv2.7.2OSV
  • shopper/framework, Packagistv2.7.3OSV
  • shopper/framework, Packagistv2.8.0OSV
  • shopper/framework, Packagistv2.8.1OSV
  • shopper/framework, Packagistv2.9.0OSV
  • shopper/framework, Packagistv2.9.1OSV

References 4