Google Merchant Center Feed
Monthly
Unauthenticated arbitrary file write in the mypresta Google Merchant Center Feed (gmfeed) module for PrestaShop lets remote attackers control the output filename, path, extension, and content written by the feed.php endpoint, enabling them to drop a PHP file and execute it for remote code execution. The flaw carries a CVSS 4.0 base score of 9.3 (independent assessment: CVSS 3.1 9.3, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting no authentication, no user interaction, and full confidentiality, integrity, and availability impact. It affects only PrestaShop stores running this third-party module below version 2.3.9, which is the vendor-fixed release; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, though the trivial unauthenticated exploitation path makes rapid patching advisable.
Unauthenticated arbitrary file write in the mypresta Google Merchant Center Feed (gmfeed) module for PrestaShop lets remote attackers control the output filename, path, extension, and content written by the feed.php endpoint, enabling them to drop a PHP file and execute it for remote code execution. The flaw carries a CVSS 4.0 base score of 9.3 (independent assessment: CVSS 3.1 9.3, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting no authentication, no user interaction, and full confidentiality, integrity, and availability impact. It affects only PrestaShop stores running this third-party module below version 2.3.9, which is the vendor-fixed release; no public exploit code has been identified at time of analysis and there is no CISA KEV entry, though the trivial unauthenticated exploitation path makes rapid patching advisable.