Is CVE-2026-114387 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114387 being exploited in the wild.

How severe is CVE-2026-114387?

High severity, with a CVSS score of 8.8, published 21 October 2026.

Which products and versions are affected?

Shopper Labs Shopper 2.0.0 to before 2.6.0.

Is there a fix for CVE-2026-114387?

Yes: fixed in 2.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114387 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114387?

Check whether you run Shopper Labs Shopper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114387: Shopper privilege escalation via missing authorization in admin panel

CVE-2026-114387 · Severity: high · CVSS 8.8 · Published 2026-10-21

Shopper is an e-commerce admin panel that manages users and permissions. A vulnerability allows low-privilege dashboard users to escalate their access to full administrator by directly calling internal functions through the Livewire update endpoint. An attacker with limited access can create new admin accounts and grant themselves any permission.

Technologies: Shopper Labs Shopper. Vendors: Shopper Labs.

Quick answers

Is CVE-2026-114387 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114387 being exploited in the wild.
How severe is CVE-2026-114387?: High severity, with a CVSS score of 8.8, published 21 October 2026.
Which products and versions are affected?: Shopper Labs Shopper 2.0.0 to before 2.6.0.
Is there a fix for CVE-2026-114387?: Yes: fixed in 2.6.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114387 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114387?: Check whether you run Shopper Labs Shopper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.6.0

Technical details

The vulnerability is a missing authorization check in the Permissions::togglePermission() and CreateTeamMember::store() Livewire components. Authenticated users with only access_dashboard permission can directly invoke these methods via /livewire/update without authorization validation, allowing role escalation and admin account creation. The fix is included in version 2.6.0.

Affected products

Shopper Labs Shopper 2.0.0 to before 2.6.0

Timeline

2026-10-21: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.