PrestaShop prior to releases 8.2.4 and 9.0.3 contains a timing side‑channel flaw in its front‑office login form that allows an attacker to determine whether a customer account exists by measuring response delays. The vulnerability is classified as CWE‑208 and can leak customer identities, a form of information disclosure that may enable targeted credential‑stuffing or phishing. While it does not provide code execution or direct data exfiltration, the knowledge of valid accounts can be leveraged in subsequent attacks.

Affected systems include PrestaShop 8.x releases up to 8.2.3 and PrestaShop 9.x releases up to 9.0.2. Any installation using those versions is vulnerable until it is upgraded to 8.2.4 or later, or to 9.0.3 or later.

The CVSS score of 5.3 indicates moderate severity. EPSS shows less than 1% probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited current exploitation. The attack vector is a remote web request to the front‑office login endpoint and requires no privileged access. An attacker can send repeated requests with different user names and compare response times to infer the existence of accounts, making the attack straightforward for automated scanners.