---
id: CVE-2026-62989
title: >-
  Shopper: missing variant-delete authorization permits destructive single and
  bulk actions
summary: >-
  Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants
  Livewire component in
  `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes
  `DeleteAction` and `DeleteBulkAction` without server-side autho…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-285
  - CWE-862
vendor: shopperlabs
product: shopper
affected:
  - shopper < 2.10.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T16:06:33.131571Z'
exploitAvailable: true
published: '2026-10-30'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T16:07:08.743Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62989'
references:
  - url: >-
      https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc
    label: >-
      https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc
  - url: 'https://github.com/shopperlabs/shopper/pull/573'
    label: 'https://github.com/shopperlabs/shopper/pull/573'
  - url: >-
      https://github.com/shopperlabs/shopper/commit/3c814f3b8eaf7cd2296c213bec0ce91e9f92a3f2
    label: >-
      https://github.com/shopperlabs/shopper/commit/3c814f3b8eaf7cd2296c213bec0ce91e9f92a3f2
  - url: 'https://github.com/shopperlabs/shopper/releases/tag/v2.10.0'
    label: 'https://github.com/shopperlabs/shopper/releases/tag/v2.10.0'
tags:
  - cve.org
  - exploit-available
epss: 0.00279
epssPercentile: 0.20446
ingestedAt: '2026-11-05T19:30:42.702Z'
---

## Overview

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.

## Affected

- `shopper < 2.10.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.