AIKIDO-2026-172024

TL;DR

Magewire exposes browser callable component actions, event listener dispatch, lifecycle hooks, and lazy load re-mounting without restricting them to the application's intended actions. A visitor can invoke inherited framework helpers, methods redeclared by Magento interceptors, Livewire lifecycle hooks such as boot or mount, and the __lazyLoad re-mount path through a crafted Magewire request, even when the component never exposed that action. This lets a visitor rerun lifecycle logic, redirect event dispatch, or trigger lazy load re-mounting outside the component's intended flow, bypassing the authorization boundary the component author assumed. The fix limits the browser callable method list to application actions, checks event listener targets, blocks direct lifecycle hook calls, and requires a genuine lazy placeholder before re-mounting.