CVE-2026-92810: PrestaShop blockwishlist through 3.0.2 Information Disclosure
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers' private wishlist contents.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated customer account is required. The attacker can request wishlist identifiers, including sequential identifiers, to retrieve share tokens for wishlists they do not own.
What information can an attacker access?
The attacker can obtain valid wishlist share links and use them to read the contents of other customers' private wishlists. The provided data does not indicate that the attacker can modify wishlist contents or access other account data.
How can I determine whether my deployment is affected?
Deployments using the PrestaShop blockwishlist module through version 3.0.2 are affected according to the provided information. Review whether authenticated customers can reach the getUrlByIdWishListAction endpoint and whether it returns share tokens without verifying wishlist ownership.