🛡️ CVE-2026-47741 — cart

🟡 CVSS 5.9 — Medium ✅ No Known Exploit CWE-362 NVD
5.9
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

shopper/framework: Race condition on Discount.usage_limit allows silent over-redemption

Impact

CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred.

A second related bug: usage_limit_per_user was effectively a no-op because the counter it relied on (DiscountDetail.total_use) was never incremented anywhere in the codebase. The per-user check therefore always saw 0 uses and validation passed regardless of how many times the same customer had previously redeemed the coupon. For eligibility = Everyone the per-user limit could not fire at all because the underlying DiscountDetail row only exists for eligibility = Customers.

Direct financial loss: each over-redemption is a discount the merchant did not intend to grant.

Patches

Fixed in v2.8.0. CreateOrderFromCartAction now:

  • Reserves the discount slot atomically before the order row is created, inside the same DB::transaction with lockForUpdate and a compare-and-swap on total_use.
  • Throws DiscountLimitReachedException::global and rolls back the transaction when the global limit was exhausted between cart validation and commit. No order is committed.
  • Throws DiscountLimitReachedException::perUser and rolls back when the discount is restricted to one use per customer and the customer has already redeemed it.
  • Snapshots discount_id, discount_code, discount_type, discount_value_at_apply and discount_currency_code onto the orders table for resilience against later discount edits or deletions.

DiscountValidator was updated to perform the same Order-based per-user check at cart-apply time so the rejection is surfaced before checkout.

Upgrade via:

composer require shopper/cart:^2.8 shopper/core:^2.8

php artisan migrate

Workarounds

None. Upgrade to v2.8.0.

Resources

  • Issue: https://github.com/shopperlabs/shopper/issues/510
  • Pull request: https://github.com/shopperlabs/shopper/pull/511
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity high, availability none.

Weakness class

CVE-2026-47741 is classified as CWE-362: Race Condition. Concurrent operations share state without proper synchronisation, so timing decides whether the result is correct.

Affected software

CVE-2026-47741 is recorded against 2 packages.

  • shopper/cart (fixed in 2.8.0)
  • unknown

Timeline and source

Published on 18 May 2026 and last revised on 8 June 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

github.com (Web)
nvd.nist.gov (Advisory)
github.com (Web)
github.com (Web)
github.com (Web)
github.com (Package)
github.com (Web)

Details

Severity Medium
CVSS Score 5.9
CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE CWE-362
Public Exploit ✅ No
Source NVD
Published 2026-05-18
Updated 2026-08-12
Modified 2026-06-08
Fix URL N/A

Affected Packages

Software From version Fixed in
shopper/cart — 2.8.0
unknown — —

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in cart

CVE-2026-47741 is rated CVSS 5.9 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.