Shopware’s Voucher Chaos: Unfixed Bug Lets Shoppers Race to Unlimited Discounts!
A race condition in Shopware voucher submission (CVE-2025-7954) lets attackers bypass usage limits. The vendor calls it a “bug” and merchants can cancel orders, but until a patch arrives, using limited vouchers is like playing roulette with your profits.
Hot Take:
Well, it looks like Shopware’s voucher system is racing faster than a caffeinated hamster on a wheel! With no patch in sight, merchants might as well be handing out free candy in a kindergarten. Memo to Shopware: When you call a security bug just a ‘bug,’ it doesn’t make it any less of a headache for merchants!
Key Points:
- Shopware 6 has a race condition vulnerability in its voucher system, allowing misuse of voucher codes.
- The vulnerability, CVE-2025-7954, allows attackers to bypass usage limits on vouchers.
- Shopware has acknowledged the issue but hasn’t provided a patch yet.
- Merchants are advised to avoid using vouchers with usage limits until a solution is available.
- SEC Consult disclosed the vulnerability after Shopware published it as a non-security issue.
Already a member? Log in here