Psgdpr
Monthly
Authenticated customers on PrestaShop stores that have the psgdpr GDPR-compliance module installed at version 1.4.3 or earlier can forge GDPR consent audit records belonging to other customers by supplying attacker-chosen customer identifiers to the module's front-office consent AJAX endpoint (FrontAjaxGdpr.php), corrupting the integrity of consent logs. Only a valid customer account is required - no administrator privileges, no user interaction, and no special store configuration beyond an active module - and publicly available exploit code exists. The flaw is not in CISA KEV (no confirmed active exploitation), and the impact is confined to integrity of the consent audit trail: no data disclosure, account takeover, or availability loss results from this issue.
Authenticated customers on PrestaShop stores that have the psgdpr GDPR-compliance module installed at version 1.4.3 or earlier can forge GDPR consent audit records belonging to other customers by supplying attacker-chosen customer identifiers to the module's front-office consent AJAX endpoint (FrontAjaxGdpr.php), corrupting the integrity of consent logs. Only a valid customer account is required - no administrator privileges, no user interaction, and no special store configuration beyond an active module - and publicly available exploit code exists. The flaw is not in CISA KEV (no confirmed active exploitation), and the impact is confined to integrity of the consent audit trail: no data disclosure, account takeover, or availability loss results from this issue.