Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the CreateOrderFromCartAction::execute process. An attacker can bypass intended usage limits by performing concurrent checkouts, resulting in discounts being applied beyond the configured maximum without detection...

CVE-2026-47741

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's totaluse counter. Under concurrent checkout pressure Black Friday, flash sale, viral coupon, the global usagelimit was...

CVE-2026-47741: Concurrent Execution using Shared Resource with Improper Synchronization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's totaluse counter. Under concurrent checkout pressure Black Friday, flash sale, viral coupon, the global usagelimit was...

PT-2026-44439

Impact CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total use counter. Under concurrent checkout pressure Black Friday, flash sale, viral coupon, the global usage limit was silently exceeded: orders were committed with the...