PrestaShop 9.2.1 and 8.2.9: 18 security fixes and what to do today

If the install folder from when your store was set up is still on your server, anyone can reinstall your PrestaShop with their own administrator and take the store over, no account needed. It is one of 18 flaws fixed on 9 November by the PrestaShop 9.2.1 and 8.2.9 security update; two others let a limited voucher be used on several orders at once, right before Black Friday. Checking whether you are affected takes two minutes.

What do PrestaShop 9.2.1 and 8.2.9 fix?

They fix 18 security flaws: PrestaShop rates 15 as high severity and 3 as medium, and recommends updating as soon as possible. These are the ones that can cost a store the most:

• The installer left on the server. Installing PrestaShop uses an install folder that has to be deleted afterwards. If it is still there, anyone can rerun the installation over your store: see your database password, break the store or reinstall it with an administrator of their own. A second flaw in that same folder lets a stranger run their own programs on your server. Both are rated 8.1 out of 10 and need no account at all.
• Vouchers used more times than allowed. A customer confirming several orders at once can use a limited voucher (single-use, or for the first 100) on all of them and get the full discount on each (7.5 out of 10).
• Duplicate orders. With a cart that comes to 0 €, several confirmations at once can create several orders from the same cart (7.5 out of 10).
• Your customers' files. If you sell customisable products, the photo or document a customer uploads can be downloaded by a stranger who knows the order reference and the file name.
• Stores connected to other software. If your ERP, a marketplace or your shipping tool connects to the store through the PrestaShop webservice, several access keys can read or change more than you gave them, including customer accounts if you run several stores on one installation.
• What someone who already gets into your back office can do. Several flaws need a back-office account, but they let whoever has one go much further than you allowed. That's your case if employees, an agency or freelancers work on your store.

Two official modules are fixed too. In the GDPR one (psgdpr 1.4.4), someone could record a consent in another customer's name, and the consent log no longer proved who agreed to what. In the newsletter one (ps_emailsubscription 3.0.1), the subscriber list you export could contain a rigged email address that the spreadsheet takes for a formula when you open it.

Does it affect my store?

Yes, unless your store is already on 9.2.1 or 8.2.9, the only two versions with the fix. There will be no fixed version for 9.0, 9.1 or 1.7.

• PrestaShop 9.2.0: affected by all 18. Update to 9.2.1.
• PrestaShop 9.0 or 9.1: affected, and its fix is 9.2.1, so you have to move up to it.
• PrestaShop 8 (8.0, 8.1 or 8.2): affected by 15. Update to 8.2.9.
• PrestaShop 1.7 or older: gets no security release, and the installer advisory explicitly includes it: it covers any version before 8.2.9.

How to check your version

In your store's back office, open Advanced Parameters → Information: the version is shown there.

Does your store's install folder respond?

Open your store's address in the browser followed by /install (for example https://yourstore.com/install) and try /install-dev as well. If you get your store's "page not found" or a server error, good. If the PrestaShop installation wizard appears, or anything else, your store is exposed to the two most serious flaws.

In April, the security firm Sansec found more than 200 live PrestaShop stores with the installer open to anyone, mostly in France, Italy, Poland and the Czech Republic. Since 9.2.0 the folder is deleted automatically when the installation ends; on version 8 stores and older it had to be deleted by hand, and that didn't always happen.

How do I update PrestaShop today?

First a backup, then the install folder, then the update. The modules and who has access come last:

1. Make a full backup (files and database) and keep it off the server.
2. Check whether the install folder responds. If it does, ask your developer or your host to delete it today and to check whether anyone has left something on the server, because it has been open to anyone.
3. Update PrestaShop: to 9.2.1 if you're on 9, to 8.2.9 if you're on 8. It's done with the Update Assistant module (formerly "1-Click Upgrade"). If your store has custom modules or a custom theme, try it on a copy first.
4. Update the two official modules, GDPR and newsletter, from Modules → Module Manager. You can do this even if the store has to wait.
5. Review who gets into your store. Delete employees who no longer work with you and the webservice keys you don't use. If no software is connected through the webservice, switch it off in Advanced Parameters → Webservice.

Deleting the install folder closes the two installer flaws, the most serious ones. Vouchers and duplicate orders are only fixed by updating.

Why does it matter so much before Black Friday?

Because Black Friday is on 27 November, and its promotions are exactly what these two flaws let people abuse: the code for the first 50, the single-use voucher you send to your list, the gift with an order that comes out free. If someone finds a way to use the same code 10 times, they'll do it on the day you give the biggest discounts and have the least time to look at orders.

There is still time to update calmly. If you can't make it, check orders with a voucher and 0 € orders before packing them: several orders from the same customer with the same code, almost in the same second, are the sign.

What if my store runs 1.7, 9.0 or 9.1?

If you're on 9.0 or 9.1, the step is to 9.2.1. Staying within PrestaShop 9, your theme and modules usually keep working. Even so, check that each one supports 9.2 and try it on a copy first.

If you're on 1.7, there's no fix for your version. Deleting the install folder protects you from the installer flaw; for the rest, the way out is moving to PrestaShop 9. There's another reason to move: 1.7 runs on PHP 7.4 at most, which gets no fixes either, as we saw with PHP2Shell three weeks ago. Which PHP each version supports is in which PHP version PrestaShop needs.

The whole move from 1.7 to 9 is explained in upgrade PrestaShop 1.7 or 1.6 to 9. And if you'd rather not keep an eye on these advisories, with PrestaShop maintenance we update PrestaShop and its modules ourselves after testing them.

For your technical team

Official notes: PrestaShop 9.2.1 and PrestaShop 8.2.9. Every core advisory lists only 9.2.1 and 8.2.9 as patched versions; no patch for 9.0.x, 9.1.x or 1.7. Three affect 9 only (Admin API: GHSA-p292-3rh4-vm4p and GHSA-6c2j-pgwm-95m9; debug mode: GHSA-95f5-jc9c-gg3q).

• Installer: GHSA-8rxw-79mh-gmm5 (8.1; affects everything before 8.2.9) and GHSA-h2q4-7fp7-m5jp (8.1). Workaround in the advisory: delete install/ (and install-dev/) after installing.
• Vouchers and 0 € orders: GHSA-r246-6gw4-pj3p and GHSA-2676-hc74-gg7v (7.5). No workaround.
• Webservice: GHSA-hjwq-7qvv-qxj4 (CVE-2026-71519), GHSA-3f36-4qv4-vfgh (CVE-2026-71531), GHSA-wrmc-gmx5-9hhc. Workaround: disable the webservice if unused and give customer permissions only to trusted integrations.
• Front office, no account: GHSA-fg9q-mm4c-h5xc (customisation files, 5.9) and GHSA-g6p7-cx52-hcrj (password reset token, 4.8).
• Back office: GHSA-99cp-c6mm-p7h5, GHSA-7q68-ch46-pxmc, GHSA-fxq4-2mc8-99pr, GHSA-95w6-v2wq-cv8w, GHSA-5p6p-mx64-96jf, GHSA-mgcf-mrg4-mcxv.
• Modules: psgdpr 1.4.4 (GHSA-wwqh-cf9m-347f, CVE-2026-92809) and ps_emailsubscription 3.0.1 (GHSA-pg6j-qf29-gc43). The Classic edition also ships PrestaShop Checkout 5.5.6.

If the installer was reachable, Sansec recommends scanning the server for backdoors and turning off debug mode in production.