CVE-2023-50026 is a critical severity (CVSS 9.8) SQL injection in the Presta Monster Multi Accessories Pro module (hsmultiaccessoriespro) for PrestaShop. A guest can reach it with no login. The advisory lists 5.3.0 as the fixed version. Upgrade the module and review the shop for signs of tampering.
What's affected
The record says versions 5.1.1 and before are affected. The Friends of Presta advisory, published 2024-02-08, says the module is affected up to and including 5.2.0 and fixed in 5.3.0. Source conflict on the version range: use the advisory's wider range and treat anything below 5.3.0 as vulnerable.
The weakness is CWE-89 (SQL injection). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H and the advisory agrees on 9.8 Critical. The vulnerable method is HsAccessoriesGroupProductAbstract::getAccessoriesByIdProducts().
Fixed version: 5.3.0, which casts the ID values to integers before they enter SQL statements across several classes. According to the advisory, a successful attack could give admin access, delete shop data, extract tokens, or alter SMTP settings to intercept email.
How to check if you're exposed
In the PrestaShop back office, open Module Manager and find the module by name, then read its version. From a shell you can read the version from the module's main file.
grep -m1 "this->version" modules/hsmultiaccessoriespro/hsmultiaccessoriespro.php
The record's version limit, 5.1.1, is lower than the advisory's, 5.2.0. If you run 5.2.0, the record would call you safe and the advisory would not, so trust the advisory.
If the check shows the module is present at a version in range, treat the shop as exposed whether or not the module is enabled, since some front controllers answer even when the module looks idle. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find every shop that uses Multi Accessories Pro and note its version.
- Upgrade the module to 5.3.0 or later, or remove it if you do not need it.
- Upgrade PrestaShop to a current release, which disables multiple statement queries.
- Review admin users, SMTP settings and recent database changes for anything you did not make.
- Enable audit logging such as ModSecurity, since standard front end logs may show only a plain POST request.
- Consider an OWASP CRS 942 rule set on a web application firewall, and expect to tune it so the back office keeps working.
Why it matters
The method builds SQL by placing product and accessory ID lists straight into the query text. Because the IDs come from a request and are not forced to numbers, a guest can change the meaning of the query. The advisory says it can be reached with a simple HTTP request through a front controller.
SQL injection is a long standing class of flaw, and it keeps appearing in shop modules because many store owners install third party add ons that nobody reviews. The usual defenses are parameterized queries and strict casting of numeric IDs. The advisory from the PrestaShop security community recommends upgrading PrestaShop itself, which turns off multiple statement queries, though it does not stop attacks that read data with UNION queries. This CVE is not on the CISA KEV list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does the attacker need an account?
No. The vector shows no privileges and no user interaction. The advisory says a guest can reach the vulnerable code.
Is changing the database prefix enough?
No. The advisory says changing the default ps_ prefix offers little protection against a skilled attacker.
Sources
Last reviewed: 19 October 2026.
