CVE-2026-47743 Shopper: Multiple data integrity and disclosure issues in admin Livewire components
Authenticated attackers can exploit XSS, IDOR, and credential exposure in Shopper admin components to steal sessions and sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-47743?
CVE-2026-47743 is a high-severity cross-site scripting vulnerability in shopperlabs shopper, published on 23 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers. No known workarounds are available.
Which versions are affected by CVE-2026-47743?
2 open source packages ship an affected version, including shopper/framework.
| Package | Affected | Fixed in |
|---|---|---|
shopper/framework Packagist | All versions | 2.8.0 |
shopper/framework Packagist | All versions | 2.8.0 |
How do I fix CVE-2026-47743?
Upgrade shopper/framework to 2.8.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-47743 being exploited?
There is no known exploitation of CVE-2026-47743 in the wild and no public exploit code.
Sources
Also known as GHSA-hr9v-r8r2-hg7j.