Multiple Vulnerabilities in Shopper E-commerce Admin Panel Affecting Low-Privilege User Actions

CVE-2026-47740

What is CVE-2026-47740?

The Shopper E-commerce Admin Panel, prior to version 2.8.0, is susceptible to an improper access control vulnerability that allows authenticated users with low privileges to execute critical actions related to order management. Specifically, users possessing read-only access were able to perform actions such as canceling orders, marking them as paid or complete, and initiating payment captures, all of which should require elevated permissions. This flaw can lead to unauthorized order modifications and real financial transactions. The vulnerability is addressed in version 2.8.0, which enhances permission validations to prevent such unauthorized actions.

References