Affected Systems

Alior Bank "raty" module for PrestaShop. CVE-2026-7848 affects versions 8.0.0 to 8.1.11 (fixed in 8.1.11 and 9.0.7). CVE-2026-15600 affects versions 8.1.9 to 8.1.12 (fixed in 8.1.12 and 9.0.8). Requires attacker access to PrestaShop backoffice product/category management.

Exploitation Status

No evidence of active exploitation reported. Vulnerabilities disclosed through coordinated disclosure process. Exploitation requires authenticated backoffice access to PrestaShop admin panel.

Business Impact

Attackers with PrestaShop backoffice credentials can execute arbitrary SQL queries via unsanitized POST parameters in product and category management functions. This enables unauthorized database access, data exfiltration, and modification of store data. Impact limited to organizations using Alior Bank payment module with vulnerable versions. Threat actor must already have admin-level access, reducing likelihood but not eliminating risk from insider threats or compromised accounts.

Urgency

🟡 Within a week

Recommended Actions

  • Identify all PrestaShop instances running Alior Bank 'raty' module versions 8.0.0 through 8.1.12 in your environment
  • Upgrade Alior Bank 'raty' module to version 8.1.12 or 9.0.8 (or later) immediately on all affected systems
  • Review PrestaShop backoffice access logs for suspicious activity in product/category edit functions, focusing on POST parameters alior_product_promotion, alior_category_promotion, alior_category_enabled, and status
  • Audit database logs for anomalous SQL UPDATE queries originating from the raty module between deployment date and patch application
  • Enforce principle of least privilege for PrestaShop admin accounts and review current backoffice user permissions

---

# Geopolitical Context

Geopolitical Context

This disclosure represents routine coordinated vulnerability disclosure (CVD) activity by Poland's national CERT, consistent with European efforts to strengthen cybersecurity hygiene in the financial services sector. Alior Bank, a major Polish retail and commercial bank, provides payment installment modules widely deployed across e-commerce platforms using PrestaShop. The vulnerabilities—affecting backend administrative functions—could enable database compromise by authenticated attackers with backoffice access, posing risks to merchant transaction data and customer financial information. The incident underscores the security challenges inherent in third-party payment integrations within the EU's increasingly digitized retail banking ecosystem, where a single module vulnerability can cascade across numerous merchant sites. CERT Polska's coordination and public disclosure align with EU NIS2 Directive expectations for transparency and timely remediation in critical infrastructure sectors.

State Actor Alignment

No state actor involvement is indicated. This is a coordinated disclosure of software vulnerabilities discovered through responsible research and reported to Poland's national CERT. The disclosure process reflects Poland's alignment with EU cybersecurity norms and the broader Western emphasis on public-private collaboration in vulnerability management. There are no sanctions implications or indicators of state-sponsored exploitation.

Business Impacty pro region

The disclosure has direct implications for the Polish and broader European e-commerce and financial services sectors. Alior Bank's installment payment module is likely deployed across numerous PrestaShop-based merchant sites in Poland and potentially other Central European markets. Unpatched instances could expose merchant databases to SQL injection attacks, risking customer payment data and transaction records. The incident highlights systemic third-party risk in the EU's digital payments infrastructure, where vulnerabilities in widely adopted banking modules can affect thousands of small and medium enterprises. It may prompt increased scrutiny from EU financial regulators (EBA, national supervisors) regarding third-party software assurance in payment processing. The timely disclosure and patching also demonstrate the maturity of Poland's national cyber coordination mechanisms, reinforcing its role as a capable cybersecurity actor within the EU and NATO.

Forecast

If merchants fail to apply patches promptly (versions 8.1.11/9.0.7 for CVE-2026-7848 and 8.1.12/9.0.8 for CVE-2026-15600), opportunistic exploitation by financially motivated actors is likely, particularly targeting smaller e-commerce operators with weaker security postures. If proof-of-concept code becomes public, the window for mass scanning and exploitation may narrow to days or weeks. Polish financial regulators may issue compliance guidance or conduct audits of affected institutions' third-party risk management practices. Broader EU-level discussions on software supply chain security in financial services are likely to reference this case, potentially influencing future technical standards under the Digital Operational Resilience Act (DORA). If similar vulnerabilities are discovered in other bank-provided e-commerce modules, coordinated multi-vendor disclosures may follow, indicating a pattern requiring sector-wide remediation.