Amasty patches dozens of Magento extensions, 6 critical

Update October 3, 2026: This advisory now lists Amasty's October batch: four more critical extensions (B2B Company Account, Affiliate, Google Account Login, Stripe) and six high-severity ones.

Update September 30, 2026: Corrected package versions for Shop by Brand, Banners Lite, Cookie Consent, RMA Premium, GDPR Pro and Quote Attributes, and raised Advanced Product Reviews, Affiliate, Custom Form, Request a Quote, Mega Menu and AI Content Generator Pro to Amasty's newer security releases.

Update September 28, 2026: This advisory now lists additional high-severity extensions.

Update August 25, 2026: This advisory now lists additional high-severity extensions.

Update August 13, 2026: This advisory now lists medium and low-severity extensions.

Update August 10, 2026: This advisory has been updated with additional high-severity vulnerabilities.

Amasty is one of the largest ecommerce extension vendors, with many thousands of modules installed worldwide. This security release affects almost every Magento & Adobe Commerce store, so you should probably take action today.

Running Sansec Shield? You are protected already!

If not, we strongly recommend to upgrade the critical extensions today, and schedule the remaining extensions for upgrade in the next 4 weeks.

Affected extensions

Critical

• Advanced Product Reviews. An attacker can upload a web shell with no login and runs code on your store, giving full control. Packages amasty/advanced-review (upgrade to 1.17.2), amasty/advanced-review-graphql (upgrade to 1.0.6).
• Gift Card. An attacker can upload a web shell with no login and runs code on your store, giving full control. Packages amasty/module-gift-card (upgrade to 2.16.4), amasty/module-gift-card-account (upgrade to 1.10.3), amasty/module-gift-card-graph-ql (upgrade to 1.0.11).

This is worse than the similar Order Attributes flaw that we covered recently, because this one allows arbitrary upload locations, which defeats the standard block on PHP execution under pub/media.

For comparison: the Order Attributes bug has been under attack since the day it was patched. Shield blocked over 12,000 attempts against 25% of all Magento stores in three days. We expect the same here.

Amasty's October batch adds four more critical issues. None of these are file uploads, so the pub/media block does not help here.

• B2B Company Account. A company user can change the email address of any customer on the store, not just customers in their own company. Packages amasty/module-company-account (upgrade to 2.10.3), amasty/module-company-account-order-approval-functionality (upgrade to 1.0.5), amasty/module-company-account-order-approval-functionality-hyva (upgrade to 1.0.4), amasty/module-company-account-approval-hyva-checkout (upgrade to 1.0.3), amasty/module-company-account-quote (upgrade to 1.2.2).
• Affiliate. An affiliate can overwrite protected fields of their own account through the widget settings form. Packages amasty/affiliate (upgrade to 2.6.2), amasty/module-affiliate-hyva (upgrade to 1.2.0).
• Google Account Login. The admin login accepts a replayed SAML response, or one issued for another service, as a valid sign-in. Package amasty/google-account-login. First secure version 1.0.3.
• Stripe. An order can be marked as paid with a payment that belongs to another order or was already used, and payments of other orders can be refunded or cancelled. Packages amasty/module-stripe (upgrade to 3.3.2), amasty/module-stripe-card-element (upgrade to 1.0.4), amasty/module-stripe-hyva-checkout (upgrade to 1.0.4), amasty/module-stripe-hyva (upgrade to 1.0.3).

High

• Improved Layered Navigation. Packages amasty/shopby (upgrade to 4.1.3), amasty/module-shop-by-quick-config (upgrade to 1.1.7).
• Product Parts Finder. Package amasty/finder. First secure version 1.15.0.
• Custom Order Number. Package amasty/number. First secure version 1.2.0.
• GeoIP Data. Package amasty/geoip. First secure version 1.7.4.
• Extended Order Grid. Package amasty/ogrid. First secure version 1.6.0.
• Subscriptions and Recurring Payments. Packages amasty/module-recurring-payments-main (upgrade to 2.5.0), amasty/module-recurring-payments-subscription-functionality (upgrade to 1.3.1), amasty/module-recurring-payments-paypal (upgrade to 2.4.1), amasty/module-recurring-payments-stripe (upgrade to 1.9.3).
• PDF Customizer. Package amasty/module-pdf-customizer. First secure version 1.7.1.
• Reward Points Facebook. Package amasty/module-rewards-facebook. First secure version 1.3.0.
• Advanced Conditions. Package amasty/module-advanced-conditions. First secure version 1.6.1.
• Yotpo. Package amasty/yotpo. First secure version 1.0.6.
• Product Option Templates. Packages amasty/product-option-templates (upgrade to 1.7.2), amasty/module-prot-hyva (upgrade to 1.1.1).
• RMA. Packages amasty/rma (upgrade to 2.11.0), amasty/module-rma-hyva (upgrade to 1.4.0).
• RMA Shipping Label. Package amasty/module-rma-automatic-shipping-label. First secure version 1.0.5.
• Exit Intent Popup. Package amasty/module-exit-popup. First secure version 1.3.0.
• Multiple Wishlist. Packages amasty/module-multiple-wishlist (upgrade to 2.2.2), amasty/module-multiple-wishlist-guest (upgrade to 1.0.1), amasty/multiple-wishlist-graphql (upgrade to 1.0.3).
• Visual Merchandiser. Package amasty/module-visual-merchandiser. First secure version 3.1.3.
• Advanced Reports. Package amasty/module-advanced-reports. First secure version 1.11.1.
• Custom Reports Builder. Package amasty/module-report-builder. First secure version 1.7.2.
• Regenerate URL Rewrites. Package amasty/module-regenerate-url-rewrites. First secure version 1.2.0.
• Import Orders and Export Orders. Packages amasty/module-order-import (upgrade to 2.2.3), amasty/module-order-export (upgrade to 2.3.3).
• Export Pro (System). Package amasty/module-export-pro. First secure version 2.2.2.
• Import Core (System). Package amasty/module-import-core. First secure version 1.14.1.
• Custom Product Sorting (System). Package amasty/custom_product_sorting. First secure version 1.2.1.
• Age Verification. Package amasty/module-age-verification. First secure version 1.0.3.
• Geo IP Redirect. Packages amasty/geoipredirect (upgrade to 1.7.4), amasty/module-geoip-redirect-hyva (upgrade to 1.1.5).
• Free Gift. Packages amasty/promo (upgrade to 2.19.0), amasty/promo-reports (upgrade to 1.0.4). The Lite edition has separate version numbering: upgrade it to 1.8.0.
• SMTP. Package amasty/smtp. First secure version 2.3.4.
• Thank You Page. Package amasty/module-thank-you-page. First secure version 1.5.0.
• Instagram Feed. Packages amasty/instagram-feed (upgrade to 3.3.0), amasty/module-instagram-feed-hyva (upgrade to 1.2.0).
• Abandoned Cart Email. Packages amasty/amcart (upgrade to 1.21.0), amasty/module-abandoned-cart-email-subscription-functionality (upgrade to 2.0.1), amasty/module-acart-hyva-checkout (upgrade to 1.0.1), amasty/module-advanced-notifications (upgrade to 1.0.1).
• Custom Form. Packages amasty/module-magento-custom-form (upgrade to 1.21.3), amasty/module-magento-custom-form-graphql (upgrade to 1.0.7), amasty/module-custom-form-hyva (upgrade to 1.3.1), amasty/module-custom-forms-pro (upgrade to 1.3.2).
• Custom Stock Status. Packages amasty/stockstatus (upgrade to 2.7.3), amasty/module-stockstatus-hyva-compatibility (upgrade to 1.1.0), amasty/custom-stock-status-msi (upgrade to 1.0.4).
• Delivery Date Manager. Package amasty/module-delivery-date-manager. First secure version 1.2.5.
• Pre Order. Packages amasty/preorder (upgrade to 2.1.2), amasty/module-pre-order-hyva-compatibility (upgrade to 1.1.2), amasty/module-pre-order-hyva-checkout (upgrade to 1.0.3).
• Push Notifications. Package amasty/module-push-notifications. First secure version 1.10.0.
• Request a Quote. Packages amasty/module-request-quote (upgrade to 2.12.5), amasty/module-quote-attributes (upgrade to 1.2.1), amasty/module-quote-attributes-hyva (upgrade to 1.1.1).
• ChatGPT AI Content Generator add-ons. Packages amasty/module-ai-content-translator (upgrade to 1.0.2), amasty/module-ai-xlanding-content-generator (upgrade to 3.2.1), amasty/module-ai-xlanding-content-translator (upgrade to 1.1.1).
• CCPA. Orders can be anonymized without a login, and an admin controller serves customer data as CSV without authentication. Package amasty/module-ccpa. First secure version 1.3.11.
• Advanced Search. Unsafe deserialization of rate limiter cache data, rate limit bypass through spoofed IP headers, prompt injection in the AI synonym generator, stored XSS in the multi-store autocomplete and query amplification in the store locator search. Packages amasty/xsearch (upgrade to 1.27.1), amasty/module-search-rate-limiter (upgrade to 1.0.2), amasty/module-advanced-search-multi-store (upgrade to 1.0.3), amasty/module-store-locator-advanced-search (upgrade to 1.0.2), amasty/module-ai-elastic-search-synonyms-content-generator (upgrade to 1.1.2), amasty/module-ai-elastic-search-synonyms-content-generator-pro (upgrade to 1.0.2).
• FAQ and Product Questions. Cross-site vote manipulation, search denial of service, email exposure and SQL injection through GraphQL, XSS in templates and an open redirect in the Hyvä back-to-product link. Packages amasty/module-faq-product-questions (upgrade to 2.16.0), amasty/module-faq-graphql (upgrade to 1.0.7), amasty/module-faq-hyva (upgrade to 1.0.9), amasty/module-faq-subscription-functionality (upgrade to 1.2.0).
• Google Analytics 4. Reflected XSS through the page type URL parameter. Package amasty/module-ga4. First secure version 3.3.0.
• Blog Pro. CSRF in comments, session ID exposure, unauthenticated access to unpublished posts and commenter emails, open redirects, SQL injection and plaintext credentials in the WordPress import, missing admin ACL checks and weak unsubscribe links. Packages amasty/blog (upgrade to 3.0.0), amasty/module-blog-hyva (upgrade to 1.5.2), amasty/blog-graphql (upgrade to 1.3.6), amasty/module-blog-api (upgrade to 1.0.2), amasty/email-unsubscribe (upgrade to 1.0.2), amasty/module-blog-pro-to-advanced-reports (upgrade to 1.0.1).
• Admin Actions Log. Previous values of encrypted configuration fields, such as API keys, are written to the log in plain text. Package amasty/adminactionslog. First secure version 2.8.1.

Medium

• Landing Pages. Packages amasty/xlanding (upgrade to 2.0.4), amasty/xlanding-graphql (upgrade to 2.0.3).
• Social Login. Packages amasty/social-login (upgrade to 2.0.5), amasty/module-social-login-pro (upgrade to 2.1.0), amasty/social-login-apple-id (upgrade to 3.0.0), amasty/social-login-graphql (upgrade to 1.0.6). The Lite edition has separate version numbering: upgrade it to 1.12.13.
• Image Optimizer. Packages amasty/module-page-speed-optimizer (upgrade to 2.5.0), amasty/module-optimizer-pro (upgrade to 3.9.0), amasty/module-image-optimizer-visited-pages (upgrade to 1.0.1).
• Follow Up Email. Package amasty/followup. First secure version 1.5.0.
• Promotions Manager. Package amasty/rgrid. First secure version 1.0.11.
• GDPR. Packages amasty/module-gdpr (upgrade to 2.15.0), amasty/module-gdpr-pro (upgrade to 2.19.2).
• Reward Points. Packages amasty/rewards (upgrade to 2.6.0), amasty/module-rewards-referral-hyva (upgrade to 1.0.5). The Lite edition has separate version numbering: upgrade it to 2.7.0.
• AJAX Shopping Cart. Packages amasty/cart (upgrade to 1.11.6), amasty/module-ajax-shopping-cart-subscription-pack (upgrade to 1.12.3).
• Mega Menu. Packages amasty/module-mega-menu-lite (upgrade to 1.5.10), amasty/mega-menu (upgrade to 2.5.8), amasty/module-mega-menu-package-pro (upgrade to 2.8.1).
• Out of Stock Notification. Packages amasty/xnotif (upgrade to 1.20.0), amasty/module-out-of-stock-hyva-compatibility (upgrade to 1.1.0).
• ChatGPT AI Content Generator. Packages amasty/ai-content-generator (upgrade to 6.1.1), amasty/module-ai-content-generator-lite (upgrade to 6.3.2), amasty/module-ai-content-generator-pro (upgrade to 5.2.0), amasty/module-ai-image-generator (upgrade to 1.3.2).
• Product Attachments. Packages amasty/product-attachment (upgrade to 3.6.0), amasty/product-attachment-lite (upgrade to 3.7.0).
• Request a Quote. Packages amasty/module-request-quote-pro-functionality (upgrade to 1.2.3), amasty/module-request-a-quote-pro-subscription-package (upgrade to 1.10.0). The Lite edition has separate version numbering: upgrade it to 2.13.4.
• Countdown Timer. Package amasty/module-promo-countdown. First secure version 1.3.1.
• XML Google Sitemap. Package amasty/module-xml-google-sitemap. First secure version 2.5.0.
• Google Customer Reviews. Package amasty/module-google-customer-reviews. First secure version 1.1.1.
• Shop by Brand. Packages amasty/module-shop-by-brand (upgrade to 3.3.2), amasty/module-shop-by-base (upgrade to 3.1.2), amasty/module-shop-by-brand-hyva-compatibility (upgrade to 1.4.0).
• Color Swatches. Package amasty/color-swatches-pro. First secure version 2.11.1.
• Import Products and Export Products. Packages amasty/module-product-import (upgrade to 2.1.3), amasty/module-product-export (upgrade to 2.2.3).
• Import Customers. Package amasty/module-customer-import. First secure version 2.1.3.
• Import Pro. Package amasty/module-import-pro. First secure version 2.1.2.
• Export Core (System). Package amasty/module-export-core. First secure version 1.14.6.
• Import Export Core (System). Package amasty/module-import-export-core. First secure version 1.4.4.

Low

• Omnibus Price Tracker. Package amasty/module-price-history. First secure version 1.7.2.
• Store Credit. Package amasty/store-credit. First secure version 1.5.2.
• Google Indexing API. Package amasty/module-google-indexing-api. First secure version 1.0.2.
• Google Rich Snippets. Package amasty/module-google-rich-snippets. First secure version 1.10.1.
• RMA. Packages amasty/rma-premium (upgrade to 1.5.0), amasty/module-rma-subscription-package-premium (upgrade to 1.6.0). Both are wrapper packages: the fix itself is amasty/rma 2.11.0 listed under High.
• Payment Restrictions. Package amasty/payrestriction. First secure version 2.5.4.
• Special Promotions. Packages amasty/module-special-promo (upgrade to 2.17.4), amasty/module-special-promo-pro (upgrade to 2.20.1).
• Shipping Cost Calculator. Package amasty/module-shipping-calculator. First secure version 1.1.2.
• Banners Lite. Package amasty/module-banners-lite. First secure version 1.2.9.
• Cookie Consent. Package amasty/gdpr-cookie. First secure version 2.18.1.
• Shipping Restrictions. Packages amasty/shiprestriction (upgrade to 2.13.1), amasty/module-ship-restriction-hyva (upgrade to 1.1.1).
• Import and Export for Advanced Product Reviews. Package amasty/reviews_import_export. First secure version 1.1.1.

Troubleshooting when upgrading

diff --git a/view/adminhtml/ui_component/amasty_xlanding_page_edit_form.xml b/view/adminhtml/ui_component/amasty_xlanding_page_edit_form.xml
index b5bbb3b..413d8bd 100644
--- a/view/adminhtml/ui_component/amasty_xlanding_page_edit_form.xml
+++ b/view/adminhtml/ui_component/amasty_xlanding_page_edit_form.xml
@@ -329,7 +329,7 @@
                 <label translate="true">Top Description</label>
             </settings>
             <formElements>
-                <wysiwyg class="Magento\Catalog\Ui\Component\Category\Form\Element\Wysiwyg">
+                <wysiwyg class="Magento\Ui\Component\Form\Element\Wysiwyg">
                     <settings>
                         <rows>8</rows>
                         <wysiwyg>true</wysiwyg>
@@ -359,7 +359,7 @@
                 <label translate="true">Bottom Description</label>
             </settings>
             <formElements>
-                <wysiwyg class="Magento\Catalog\Ui\Component\Category\Form\Element\Wysiwyg">
+                <wysiwyg class="Magento\Ui\Component\Form\Element\Wysiwyg">
                     <settings>
                         <rows>8</rows>
                         <wysiwyg>true</wysiwyg>

Sansec Shield protection

Sansec Shield already blocks the critical issues. It inspects incoming requests and rejects dangerous file uploads before they reach disk, whatever your pub/media config. The rule is not tied to a signature, so it also stops the wider class of unauthenticated upload attacks. Emergency mitigation for the medium severity issues is in progress.

Amasty and Sansec partner up

We applaud Amasty with this release. Upgrading this many extensions at once can be painful for merchants, but eventually this will pay off with fewer hacked stores.

We are also proud to announce that as of today, Sansec and Amasty are official partners. Amasty merchants get 20% off the first year of any Sansec product with coupon code AMASTY at checkout.

Recommendations

1. Update now: Upgrade every affected Amasty extension to the first secure version listed above. Some releases are backward incompatible.
2. Block attacks: Deploy Sansec Shield to block exploitation of the critical file upload flaws in real time, including on stores that cannot patch immediately.
3. Scan for compromise: Run eComscan to detect webshells, backdoors and other malware.
4. Check web directories: Review unexpected files, especially .php, .phtml, .phar, .html and .svg.
5. Block PHP in media: Ensure pub/media cannot execute PHP as defense in depth.

Timeline

Read more

• Unauthenticated file upload in Amasty Order Attributes for Magento
• Critical vulnerability in Mirasvit Cache Warmer for Magento
• Adobe patches critical Magento account takeover (APSB26-92)
• Adobe patches critical Magento admin takeover via menu injection
• Magento Security Release APSB25-08 [Impact Analysis]