TI-2020-16045 Aliases CVE-2020-26224

Improper Access Control in PrestaShop

LOW 36CWE-284Published 2020-11-16 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the function that allows a shopping cart to be recreated from an order already placed. The problem is fixed in 1.7.6.9.

Why it matters now

EPSS 0.01764 78th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
PrestaShop	PrestaShop	>= 1.4.10.0 < 1.7.6.9	—	No fix listed	CNA

PrestaShop VendorPrestaShop Affected >= 1.4.10.0 < 1.7.6.9 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:prestashop:prestashop::::::::	before 1.7.6.9	Vulnerable	PrestaShop

cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* Versions before 1.7.6.9 Vulnerable ·PrestaShop

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-26224

References

Exploit 1

https://github.com/PrestaShop/PrestaShop/commit/709d9afab7bdba1de5d7225a40e4f28c35975909

Advisory 1

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-frf2-c9q3-qg9m

TI-2024-27717 An issue in Prestashop v.8.1.7 and before allows a remote attacker to execute arbitrary… CVSS 3.1CRITICAL 9.8
TI-2024-23013 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload CVSS 3.1CRITICAL 9.7
TI-2018-06367 modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu… CVSS 3.0CRITICAL 9.8
TI-2025-19098 A PHAR deserialization vulnerability in the _getHeaders function of PrestaShop v8.2.0… CVSS 3.1MEDIUM 6.5
TI-2018-13560 PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to… CVSS 3.0CRITICAL 9.8
TI-2021-02206 The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the… CVSS 3.1CRITICAL 9.8

See all 92 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences