CVE-2026-56825High· 8.1▾ MidnightPoC availableShopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.5%
0.5% → 0.5%
Last analysed / modified upstream
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
shopper/framework < 2.9.2Patched in:
shopper/framework 2.9.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56827High· 8.1Shopper is a Headless e-commerce Admin Panel
CVE-2026-56829High· 8.1Shopper is a Headless e-commerce Admin Panel
CVE-2026-56830Medium· 6.5Shopper is a Headless e-commerce Admin Panel
CVE-2026-56828High· 8.8Shopper: read-only team permissions allow administrator creation and permission escalation
CVE-2026-114387High· 8.8Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
CVE-2026-56831Medium· 6.5Shopper is a Headless e-commerce Admin Panel