What’s Vulnerable › Vulnerabilities

CVE-2020-26224: Improper Access Control in PrestaShop

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-16 · updated 2026-06-17
• Weakness: CWE-284

Description

In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.

Affected products

• PrestaShop: before 1.7.6.9 — fixed in 1.7.6.9

How to fix

Upgrade to a fixed version: PrestaShop 1.7.6.9. Check the vendor advisory for mitigations.

References

• https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9m
• https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9m

Get alerted when CVE-2020-26224 or the next vulnerability affects your stack