A race condition in Shopper’s CreateOrderFromCartAction::execute allows the discount usage counter to be incremented after an order is committed, causing discount usage to exceed its intended global limit. The flaw does not provide code execution or direct manipulation of system resources; its primary impact is that merchants can receive more revenue reduction than authorized, leading to monetary loss and potential violations of coupon terms.

Shopper Labs’ Shopper head‑less e‑commerce admin panel, versions released prior to 2.8.0. No specific sub‑versions are listed; any build before the patch may be affected.

The CVSS score is 5.9, indicating a moderate assessment of severity. There is no EPSS data available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would most likely trigger this condition by accelerating checkout requests under high‑traffic scenarios—such as flash sales or a coordinated coupon abuse strategy—to coerce the system into processing more orders than the usage limit permits. The vulnerability requires concurrent access to the same discount record and does not rely on external exploits beyond normal e‑commerce traffic patterns.