CVE-2026-47743
Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers. No known workarounds are available.
INFO
Published Date :
July 23, 2026, 6:16 p.m.
Last Modified :
Oct. 24, 2026, 1:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | MITRE-CVE |
Solution
- Update Shopper to version 2.8.0 or later.
- Ensure model identifiers are marked with #[Locked].
- Securely handle password hashing and avoid client-side exposure.
- Escape data before rendering and generating HTML content.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-47743.
| URL | Resource |
|---|---|
| https://github.com/shopperlabs/shopper/pull/511 | |
| https://github.com/shopperlabs/shopper/security/advisories/GHSA-hr9v-r8r2-hg7j |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-47743 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-47743
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-47743 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-47743 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Added Translation Title: shopper de shopperlabs, Description: Shopper es un Panel de administración de e-commerce sin cabeza. Antes de la versión 2.8.0, tres defectos relacionados en los componentes Livewire de administración permitieron la manipulación de datos, la divulgación de datos sensibles y XSS almacenado. Primero, varios componentes Livewire en el panel de administración expusieron identificadores de modelos Eloquent como propiedades públicas sin el atributo “#[Locked]”. Un usuario autenticado podría reescribir la carga útil de wire desde el navegador para apuntar a cualquier ID de registro, eludiendo el alcance implícito impuesto por el enrutamiento de la página. Segundo, “Customers/Create::store()” volvió a pasar un campo de formulario “Hidden” “_password” directamente a la carga útil de creación. La contraseña en texto plano se renderizó en el HTML y se transportó a través de la instantánea de Livewire en texto claro, exponiendo credenciales en el DOM de la página y en cualquier registro que capture cargas útiles de Livewire. Finalmente, el campo de código de barras del producto se renderizó a través de “DNS1DFacade::getBarcodeHTML()” con “{!! !!}”. Un atacante con permiso de “edit_products” podría persistir una carga útil maliciosa en el campo del código de barras que se ejecutaría en el navegador de cualquier usuario administrador que viera ese producto, permitiendo el robo de sesión y el encadenamiento de acciones privilegiadas. A partir de la v2.8.0, todos los identificadores de modelos Livewire vulnerables ahora están marcados como “#[Locked]”; “Customers/Create” ya no envía la contraseña de ida y vuelta a través de un campo de formulario Hidden; la contraseña en texto plano se hashea en el límite de la acción y nunca se devuelve al cliente; y la renderización del código de barras del producto ahora escapa el valor antes de pasarlo al generador de códigos de barras y la salida se envuelve en un contexto “[svg_tag]” que no interpreta los manejadores de eventos. No se conocen soluciones alternativas disponibles. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jul. 23, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-47743', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-07-23T18:18:55.397643Z'} -
New CVE Received by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'shopperlabs', 'product': 'shopper', 'versions': [{'status': 'affected', 'version': '< 2.8.0'}]}] Added Description Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers. No known workarounds are available. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Added CWE CWE-79 Added CWE CWE-200 Added CWE CWE-639 Added Reference https://github.com/shopperlabs/shopper/pull/511 Added Reference https://github.com/shopperlabs/shopper/security/advisories/GHSA-hr9v-r8r2-hg7j