---
id: CVE-2026-56826
title: Shopper is a Headless e-commerce Admin Panel
summary: >-
  Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2,
  authenticated users who could reach the Settings pages with only
  access_setting could directly invoke destructive actions through the Livewire
  endpoint because package…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-862
vendor: shopper
product: shopper/framework
affected:
  - 'shopper/framework >= 2.0.0, < 2.9.2'
patched:
  - shopper/framework 2.9.2
published: '2026-10-13'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T02:17:19.377'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56826'
references:
  - url: >-
      https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff
    label: security-advisories@github.com
  - url: 'https://github.com/shopperlabs/shopper/pull/570'
    label: security-advisories@github.com
  - url: 'https://github.com/shopperlabs/shopper/releases/tag/v2.9.2'
    label: security-advisories@github.com
  - url: >-
      https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57
    label: security-advisories@github.com
  - url: >-
      https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-f7h9-qv4x-9x57'
tags:
  - nvd
  - ghsa
  - composer
  - cve.org
  - exploit-available
epss: 0.00338
epssPercentile: 0.27064
aliases:
  - GHSA-f7h9-qv4x-9x57
ecosystem: composer
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-17T00:40:47.210725Z'
ingestedAt: '2026-09-12T00:03:49.069Z'
---

## Overview

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-56826)

Affected packages:

- `shopper/framework >= 2.0.0, < 2.9.2`

Patched in:

- `shopper/framework 2.9.2`

Source: https://github.com/advisories/GHSA-f7h9-qv4x-9x57