CVE-2020-11007: Negative charge in shopping cart possible in Shopizer

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-04-16 · updated 2026-06-17
Weakness: CWE-20

Description

In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0.

Affected products

shopizer-ecommerce Shopizer: before 2.11.0 — fixed in 2.11.0

How to fix

Upgrade to a fixed version: shopizer-ecommerce Shopizer 2.11.0. Check the vendor advisory for mitigations.

References

https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a
https://github.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-w8rc-pgxq-x2cj
https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a
https://github.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-w8rc-pgxq-x2cj

Get alerted when CVE-2020-11007 or the next vulnerability affects your stack