E-commerce Admin Panel Vulnerability in Shopper by Shopper Labs

CVE-2026-56826

What is CVE-2026-56826?

The vulnerability in the Shopper e-commerce admin panel allows authenticated users limited access to invoke destructive actions via the Livewire endpoint. Specifically, those with 'access_setting' permissions could exploit this flaw to bypass server-side authorization checks. As a result, they could delete carrier options, shipping zones, tax zones, and tax rates, leading to significant disruptions in the checkout process, including shipping and payment method mappings and incorrect tax calculations. This issue has been addressed in version 2.9.2.

References