The Google Merchant Center Feed (gmfeed) module for PrestaShop contains an unauthenticated arbitrary file write weakness in its feed.php endpoint. An attacker can craft a request that specifies the output file name, path, extension, and content through request parameters. Because the endpoint lacks authentication and input validation, the attacker can cause the server to write files with executable PHP code and then execute them, achieving full remote code execution. This flaw compromises confidentiality, integrity, and availability of the affected system.

The vulnerability affects the MyPresta Google Merchant Center Feed module for PrestaShop. Versions earlier than 2.3.9 are impacted; the fix is incorporated in version 2.3.9 and later.

The CVSS score of 9.3 classifies this as a critical vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so the exact probability of exploitation is unknown. However, the lack of authentication and the ability to write arbitrary PHP code make the attack vector straightforward and indiscriminate, allowing malicious actors to exploit it from any network that can reach the feed.php endpoint.