CVE-2024-36682

Name of the Vulnerable Software and Affected Versions PrestaShop module "Theme settings" (pk themesettings) versions <= 1.8.8

Description The issue allows a guest to download a txt file containing collected email addresses when the shop is in maintenance mode, due to a lack of permissions control. This can lead to a leak of personal information.

Recommendations For versions <= 1.8.8, consider disabling the maintenance mode or restricting access to the module "Theme settings" (pk themesettings) until a fix is available. As a temporary workaround, restrict access to the txt file that collects email addresses to minimize the risk of exploitation.