CVE-2026-62989

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.10.0

Description The Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php lacks server-side authorization for DeleteAction and DeleteBulkAction. An authenticated staff user with edit products permissions can access the endpoint /shopper/products/{id}/edit to obtain the signed component state. Subsequently, the callTableAction and callTableBulkAction paths allow the permanent deletion of single or multiple product variants without verifying the delete product variants permission. This can lead to the destruction of the sellable catalogue and disruption of storefront product pages, cart, and checkout processes.

Recommendations Update to version 2.10.0.