An authenticated staff user who is granted an "edit_products" role, but not the dedicated "delete_product_variants" permission, can exploit the Shopper admin panel to permanently delete product variants. The vulnerability lies in the Livewire component that handles delete actions and exposes them without server‑side authorization checks. Deleting variants removes sellable items from the storefront, breaks product pages, and consequently hampers cart and checkout functionality, causing a loss of revenue and user trust. The weakness corresponds to improper authorization and abuse of user‑controlled keys (CWE-285 and CWE-862).

The flaw exists in Shopper version 2.9.x and earlier, as the fix was introduced in release 2.10.0. The impacted vendor is Shopper Labs and the affected product is the Shopper Headless e‑commerce Admin Panel. Only systems that have an authenticated staff user with "edit_products" rights are at risk, as the vulnerability is only exploitable when that publicly available endpoint is accessed.

With a CVSS score of 8.1, the vulnerability is considered high severity. Though an EPSS score is not available, the lack of a publicly documented exploitation and the need for an authenticated user reduces the general attack surface. The issue is not currently listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack vector is internal or social‑engineering based; a malicious staff account or a compromised credential could perform the destructive delete actions once the vendor’s default permissions are misconfigured.