Administrative Mandate CVE-2026-50986

Exploitation requires: (1) the target PrestaShop store has the totadministrativemandate module installed and configured as an active payment method - it is absent from default installations; (2) an order exists in awaiting-payment status with an order identifier known or accessible to the attacker, typically obtained by placing a real order; (3) a store administrator must be actively authenticated to the back office and must be induced to follow a crafted URL or visit a malicious page during that session (reflected in UI:R from the CVSS vector). Exploitation is constrained to stores explicitly using this French public-sector payment module. The attacker requires no credentials themselves but must successfully social-engineer an authenticated admin.

The NVD-assigned CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) appears materially overstated relative to the described impact. The vulnerability allows order status manipulation - confirming payment not yet received - which is a high-integrity-impact action. The C:H and A:H component assignments are not substantiated by the description and likely reflect a generic template rather than a tailored assessment of this specific CSRF. An independent metric analysis reduces the score to approximately 6.5 (Medium) when Confidentiality and Availability are correctly set to None. The EPSS score of 0.14% at the 4th percentile and the absence of a CISA KEV listing indicate very low real-world exploitation probability. Deployment footprint is narrow: this module serves a niche French public-sector payment workflow and is not present in standard PrestaShop installations. Real-world risk is low for the broad population but genuine for merchants relying on this module for administrative mandate payments - fraud through unearned order confirmation is the concrete business harm.

An attacker places an order on a targeted PrestaShop store using the administrative mandate payment method, leaving the order in awaiting-payment status. The attacker then crafts a URL pointing to the unprotected payment validation controller with the relevant order ID embedded and delivers it to the store administrator via phishing email or a compromised web page. When the authenticated administrator's browser loads the link, it submits the state-changing request without a CSRF token check, and the order is confirmed as paid - enabling the attacker to receive goods or services without having transferred funds.