Historical notice about mass registrations in PrestaShop 1.6 and 1.7

This notice is historical and refers to old PrestaShop branches. It cannot be used to diagnose the cause of current registrations without checking the version, modules and logs.

The flaw described was fixed in PrestaShop 1.7.5.2 and 1.6.1.24. If a shop still uses an affected version, installing a CAPTCHA is not enough: it must be migrated to a currently maintained branch, testing the upgrade in a staging environment.

If the problem appears in a current version, first identify which form or API is creating the accounts, review the requests and update the core, theme and modules. Add compatible, server-side validated protection to the form, together with rate limits and monitoring of sign-ups.

Do not delete accounts in bulk without checking orders, consents and legitimate activity. Keep a backup before cleaning up data.

The historical flaw involved accepting URLs inside customer names, which could then be spread through the shop's notifications. The 2019 fix does not mean preventing all automated sign-ups, nor is it a recommendation to use those versions today.

To check a current mitigation, test in staging a legitimate sign-up and another without the required anti-bot validation. Check that the server rejects the second one before creating the user or sending email. Also monitor the volume of sign-ups after the change.