The vulnerability is caused by missing authorization checks in the store() methods of the Product editor's Livewire sub‑form components in Shopper. Any authenticated admin panel user, regardless of role, may submit a Livewire request to mutate a product's price, inventory, SEO metadata, shipping dimensions, or attached files. This allows an attacker to alter critical product information without the required edit_products permission, effectively compromising the integrity of the catalog.

ShopperLabs Shopper, prior to version 2.8.0. The authorization flaw exists in all sub‑form components involved in editing product details such as pricing, inventory, SEO, shipping, and media attachments.

The vulnerability is rated CVSS 6.5 and is not listed in the KEV catalog. The EPSS score is not available. An attacker must be authenticated to the admin interface and can then manipulate the livewire payload to target any product ID. The likely attack vector is a legitimate authenticated user within the admin panel. While the flaw lacks a remote execution path, it represents a medium‑risk integrity violation that could lead to significant operational impact if misused.