---
id: CVE-2026-92810
title: >-
  PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in
  the getUrlByIdWishListAction method, allowing authenticated customers to
  retrieve share tokens for any wishlist by identifier
summary: >-
  PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in
  the getUrlByIdWishListAction method, allowing authenticated customers to
  retrieve share tokens for any wishlist by identifier. Attackers can supply
  sequential…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-639
vendor: PrestaShop
product: blockwishlist
affected:
  - blockwishlist <= 3.0.2
published: '2026-09-16'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:43:58.793'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92810'
references:
  - url: 'https://github.com/PrestaShop/blockwishlist'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/PrestaShop/blockwishlist/blob/v3.0.2/controllers/front/action.php#L411-L421
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/geo-chen/oss/blob/main/prestashop.md#finding-2-blockwishlist-idor-wishlist-share-token-disclosure-via-missing-authorization-check
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/prestashop-blockwishlist-through-3.0.2-information-disclosure
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00342
epssPercentile: 0.24949
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-17T14:56:40.661096Z'
ingestedAt: '2026-09-16T21:05:36.882Z'
---

## Overview

PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retrieve share tokens for any wishlist by identifier. Attackers can supply sequential wishlist identifiers to obtain valid share links and read other customers' private wishlist contents.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.