Shopper, a headless e‑commerce admin panel, had a missing function‑level authorization check for several Livewire components that handle settings. Authenticated users possessing only the access_setting permission could trigger delete actions on shipping carrier options, shipping zones, tax zones, and tax rates. This allowed them to remove critical checkout and tax configuration data, potentially rendering the store unable to calculate shipping, map payment methods, or correctly compute tax amounts. The flaw is a classic authorization bypass (CWE‑862) that permits destructive state changes without proper privilege verification.

Vendors affected are ShopperLabs’ Shopper product. The vulnerability affects versions from 2.0.0 through and including 2.9.1. Version 2.9.2 incorporates the fix, so any deployment of Shopper 2.9.2 or newer is considered safe. Users running older releases should review their version and apply the update promptly.

The CVSS base score of 5.4 indicates moderate severity, and an EPSS score is not available, so precise exploitation likelihood is unknown. However, the flaw can be leveraged by any authenticated user who owns only minimal setting‑level access, making the attack vector local to the application. Since the authorization check is missing on the server side, the attacker can send direct Livewire requests to delete entities without being prompted for higher privileges. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the possibility of a low‑privilege internal attack raises urgent concern.