CVE-2026-56826

Name of the Vulnerable Software and Affected Versions Shopper versions 2.0.0 through 2.9.1

Description Authenticated users with the access setting permission can perform unauthorized destructive actions via the Livewire endpoint. This occurs because four Livewire components in the Settings area do not enforce server-side authorization for delete and edit actions. An attacker can delete carrier options, shipping zones, tax zones, and tax rates, which disrupts the storefront checkout process by breaking shipping-rate calculations, removing region-scoped payment methods, and corrupting tax resolution.

The affected components and their corresponding files are:

In the ZoneShippingOptions component, the deleteAction() function allows the deletion of a record using a client-supplied id variable without any permission check.

Recommendations Update Shopper to version 2.9.2. As a temporary mitigation, restrict the access setting permission to only highly trusted administrative users.