Unauthenticated file write to PHP code execution in MyPresta Google Merchant Center Feed for PrestaShop (CVE-2026-85520)
A working exploit is public in VulnCheck XDB and VulnCheck added the flaw to its KEV catalog on 2026-09-29; any shop still running a gmfeed release below 2.3.10 leaves a no-auth PHP write path exposed on its public storefront.
The module's feed.php endpoint lets an unauthenticated request control the output file name, path, extension and content when the catalog is generated by URL with Save to file enabled, so an attacker can drop a PHP file into the shop and execute arbitrary code on the server.
Affected: MyPresta Google Merchant Center Feed (gmfeed) for PrestaShop >= 1.9.1 <= 2.3.8 per the CVE record; vendor states anything below 2.3.10 is vulnerable
How to Test
In the PrestaShop Back Office open Modules → Module manager and check the installed Google Merchant Center Feed version; anything below 2.3.10 is vulnerable. Inspect modules/gmfeed/ for unexpected or recently modified PHP files — the vendor warns an in-place overwrite can leave the old public script on the server — and review web server logs for unauthenticated requests to the module's feed.php endpoint carrying file name, path or extension parameters, treating any such request as a possible webshell drop.
How to Patch
Uninstall the module via Modules → Module manager with 'delete the module files' checked so modules/gmfeed/ is actually removed, then install 2.4.1 from the product page or your MyPresta.eu order history (minimum safe version 2.3.10); do not reuse a 2.3.9 or older zip and do not overwrite files in place. Until the clean reinstall is done, stop generating the catalog by URL with Save to file enabled (the fixed release restricts that function to a trusted Back Office link).