Discount Over-Redemption Vulnerability in Shopper E-commerce Admin Panel

CVE-2026-47741

What is CVE-2026-47741?

The Shopper E-commerce Admin Panel, prior to version 2.8.0, exposed merchants to a serious risk during high-traffic events such as Black Friday sales. The vulnerability arises from a flaw in the CreateOrderFromCartAction::execute method, where the system creates order entries before accurately checking and updating the discount's total usage counter. Under conditions of concurrent checkouts, this flaw could lead to the global discount usage limit being exceeded without the merchant's knowledge. Orders could be processed with discounts fully applied even after the limitations had been breached, leaving businesses susceptible to significant financial losses. This issue has been addressed in version 2.8.0.

References