Vulnerability Description
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers' private wishlist contents.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/PrestaShop/blockwishlist
- https://github.com/PrestaShop/blockwishlist/blob/v3.0.2/controllers/front/action
- https://github.com/geo-chen/oss/blob/main/prestashop.md#finding-2-blockwishlist-
- https://www.vulncheck.com/advisories/prestashop-blockwishlist-through-3.0.2-info
FAQ
What is CVE-2026-92810?
CVE-2026-92810 is a vulnerability with a CVSS score of 4.3 (MEDIUM). PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identi...
How severe is CVE-2026-92810?
CVE-2026-92810 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92810?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.