CVE-2026-92810 Overview
CVE-2026-92810 is an Insecure Direct Object Reference (IDOR) vulnerability in the PrestaShop blockwishlist module through version 3.0.2. The getUrlByIdWishListAction method fails to validate wishlist ownership before returning share tokens. Any authenticated customer can iterate sequential wishlist identifiers and retrieve valid share links belonging to other customers. Those share URLs grant read access to private wishlist contents, exposing product interest data across the storefront.
Critical Impact
Authenticated attackers can enumerate wishlist identifiers to disclose share tokens and read arbitrary customers' private wishlist contents without additional privileges.
Affected Products
- PrestaShop blockwishlist module versions up to and including 3.0.2
- PrestaShop storefronts deploying the wishlist block front controller
- Merchant sites exposing controllers/front/action.php from the affected module
Discovery Timeline
- 2026-09-16 - CVE-2026-92810 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92810
Vulnerability Analysis
The defect lives in the getUrlByIdWishListAction method of the blockwishlist front controller at controllers/front/action.php. The handler accepts a wishlist identifier from the authenticated customer and returns the corresponding share URL. It performs no check that the requesting customer owns the referenced wishlist. Because wishlist identifiers are sequential integers, an attacker can walk the identifier space and harvest share tokens en masse. Each captured token dereferences to the target wishlist's contents through the module's public share endpoint, disclosing product selections tied to individual customers. The weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Root Cause
The controller relies on possession of a wishlist identifier as an implicit authorization signal. It never compares the wishlist's owner customer ID to the session's authenticated customer. Missing ownership enforcement in a per-object action turns a predictable identifier into a direct object reference.
Attack Vector
An attacker authenticates as an ordinary customer on the storefront. The attacker issues repeated requests to the getUrlByIdWishListAction endpoint, incrementing the id_wishlist parameter. Each response returns a share token, which the attacker resolves against the wishlist share URL to read the target's items. Exploitation requires only low-privileged access and no user interaction from the victim.
See the vulnerable code snippet and the IDOR analysis writeup for the specific handler path.
Detection Methods for CVE-2026-92810
Indicators of Compromise
- Repeated authenticated requests to the getUrlByIdWishListAction action with sequentially incrementing id_wishlist values from a single customer session or IP
- Elevated volume of hits against wishlist share URLs originating from non-owning customer accounts
- Access log bursts targeting the blockwishlist front controller outside typical customer browsing patterns
Detection Strategies
- Parse PrestaShop access logs for blockwishlist action requests and flag sessions that reference more than a small number of distinct wishlist IDs
- Correlate authenticated customer IDs against the id_wishlist values they request, alerting on mismatches
- Deploy a web application firewall rule that rate-limits requests to the wishlist action controller per session
Monitoring Recommendations
- Enable verbose access logging on the controllers/front/action.php endpoint to retain full query strings
- Ship storefront logs to a centralized analytics pipeline for enumeration pattern detection
- Review database audit trails for unusual read patterns against the wishlist and wishlist_product tables
How to Mitigate CVE-2026-92810
Immediate Actions Required
- Upgrade the blockwishlist module to a version above 3.0.2 once the maintainers publish a fix
- Audit web server logs for prior enumeration attempts against the wishlist action endpoint
- Notify customers whose wishlist contents may have been disclosed if enumeration is confirmed
Patch Information
Monitor the PrestaShop blockwishlist repository and the VulnCheck advisory for the official patched release. The fix must add an ownership check that compares the wishlist's id_customer against the authenticated session customer before returning any share URL.
Workarounds
- Disable the blockwishlist module on affected storefronts until a patched release is available
- Apply a local patch to getUrlByIdWishListAction that rejects requests when the wishlist owner does not match the session customer
- Restrict access to the wishlist action endpoint via a reverse proxy rule until upstream remediation lands
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
