The totadministrativemandate module for PrestaShop, released before version 1.8.1, is vulnerable to Cross Site Request Forgery. The payment validation controller accepts requests without a CSRF token, permitting an attacker to change an order from an awaiting state to a confirmed state by sending a crafted HTTP request. Based on the description, it is inferred that the attacker can abuse this flaw to fraudulently approve transactions, exposing the merchant to financial loss and reputational damage.

PrestaShop installations that use the totadministrativemandate module older than version 1.8.1 are affected. The module is a payment gateway extension used to confirm orders via administrative mandates. No specific operating system or environment constraints are mentioned, so any installation using the vulnerable module is at risk.

The CVSS score of 8.8 indicates a high severity, but the EPSS score of less than 1% indicates a very low probability that this vulnerability is actively exploited in the wild. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited real‑world usage. Based on the description, the likely attack vector involves delivering a malicious link to a user with permission to confirm orders, or exploiting a session that already has authorization privileges. No known public exploit exists, so the immediate threat is low, but the potential impact if an exploitation occurs is significant.