Executive brief
Four admin interface components in Shopper (a PHP e-commerce platform) fail to validate user permissions before allowing deletion of critical checkout configuration—shipping zones, tax rates, carrier options, and tax zones. A low-privileged staff member holding only basic settings access can delete these records, breaking the storefront's shipping calculations, tax resolution, and payment method availability for customers.
Technical details
The vulnerability lies in four Livewire/Filament components (`Settings\Zones\ZoneShippingOptions`, `Settings\Zones\Detail`, `Settings\Taxes\Detail`, `Settings\Taxes\TaxRates`) that define destructive `delete` and `edit` actions without calling `->authorize()` or applying authorization guards. The parent page only checks a coarse `access_setting` permission, and child components re-execute HTTP handler code at the `/livewire/update` endpoint without re-checking permissions. The most direct case is `ZoneShippingOptions::deleteAction()`, which deletes a `CarrierOption` by a client-supplied ID with no permission check or scoping. Attack surface is the Livewire component update endpoint, reachable over the network by any authenticated user. Impact includes deletion of shipping rates, zones, tax configuration, and payment method mappings, rendering the checkout flow non-functional. Version 2.9.2 is patched; versions ≥2.0.0 and <2.9.2 are vulnerable.
Affected products
- Shopper Labs Shopper Framework >= 2.0.0, < 2.9.2
Timeline
- 2026-06-22: disclosed
- 2026-09-11: advisory: Published to GitHub Advisory Database
- 2026-09-11: patched: Version 2.9.2 released