Medium severity · published Sep 16, 2026
CVE-2026-92810
PrestaShop blockwishlist through 3.0.2 Information Disclosure
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers' private wishlist contents.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
blockwishlist · PrestaShop
through 3.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92810
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92810
github.com
https://github.com/PrestaShop/blockwishlist
github.com
https://github.com/PrestaShop/blockwishlist/blob/v3.0.2/controllers/front/action.php#L411-L421
github.com
https://github.com/geo-chen/oss/blob/main/prestashop.md#finding-2-blockwishlist-idor-wishlist-share-token-disclosure-via-missing-authorization-check
www.vulncheck.com
https://www.vulncheck.com/advisories/prestashop-blockwishlist-through-3.0.2-information-disclosure
More from blockwishlist
8.8
CVE-2022-31101
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists