PrestaShop CVE-2026-44212

Upgrade immediately to PrestaShop 8.2.6 (for 8.x installations) or PrestaShop 9.1.1 (for 9.x installations) as documented in GitHub Security Advisory GHSA-w9f3-qc75-qgx9 at https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-w9f3-qc75-qgx9. The vendor explicitly states no workarounds exist, making patching the only effective remediation. As an interim compensating control until patching is complete, restrict access to the back-office Customer Service interface to trusted networks only via IP allowlisting or VPN requirement, which reduces attack surface by preventing arbitrary internet users from accessing the vulnerable view even if malicious payloads are submitted; however, this does not prevent payload injection via the public Contact Us form and only delays exploitation. Additionally, implement Content Security Policy headers on back-office pages to restrict inline script execution, though this may interfere with legitimate PrestaShop administrative functionality and requires testing. Train administrative staff not to open customer service threads from untrusted or suspicious contact form submissions until patching is complete, though this is operationally impractical for active customer service operations. These compensating controls provide limited risk reduction and should not replace immediate patching.