Is CVE-2026-47740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47740 being exploited in the wild.

How severe is CVE-2026-47740?

High severity, with a CVSS score of 8.1, published 29 May 2026.

Which products and versions are affected?

shopper/framework (Packagist) ECOSYSTEM:introduced=0,fixed=2.8.0.

Is there a fix for CVE-2026-47740?

Yes. shopper/framework (Packagist): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47740 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-47740?

Check whether you run shopper/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47740: Shopper Missing Authorization in Order and Shipment Actions

CVE-2026-47740 · Severity: high · CVSS 8.1 · Published 2026-05-29

Shopper is a headless e-commerce administration panel used to manage online stores. A security flaw allowed staff members with limited 'read-only' access to perform restricted actions, such as canceling orders, marking them as complete, or even triggering actual payment captures from customers. This could lead to unauthorized financial transactions and disruption of business operations by low-privileged internal users.

Technologies: shopper/framework (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-47740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47740 being exploited in the wild.
How severe is CVE-2026-47740?: High severity, with a CVSS score of 8.1, published 29 May 2026.
Which products and versions are affected?: shopper/framework (Packagist) ECOSYSTEM:introduced=0,fixed=2.8.0.
Is there a fix for CVE-2026-47740?: Yes. shopper/framework (Packagist): upgrade to 2.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47740 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-47740?: Check whether you run shopper/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

shopper/framework (Packagist): upgrade to 2.8.0 or later
```
composer require shopper/framework:^2.8.0
```

Technical details

An authorization bypass vulnerability exists in Shopper's admin panel due to missing permission checks on several Filament actions. Specifically, actions such as 'cancel', 'mark paid', 'mark complete', 'capture payment', 'archive', and 'start processing' were incorrectly accessible to users with only 'read_orders' permissions instead of requiring 'edit_orders'. Additionally, shipment-related actions like 'mark delivered' and 'edit tracking' only required 'browse_orders' access. An authenticated attacker with low-level read access can exploit this to manipulate the order lifecycle and trigger real-world payment captures via Payment Service Providers (PSPs). The issue is resolved in version 2.8.0 by implementing proper authorization gates on these actions.

Affected products

Shopper Labs shopper/framework < 2.8.0

Identifiers

CVE-2026-47740
GHSA-f946-9qp6-vgch

Timeline

2026-05-11: patched: Fix merged in pull request #511
2026-05-11: advisory: GitHub Security Advisory published
2026-05-29: disclosed: CVE-2026-47740 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.