# Is it safe to stay on PrestaShop 1.7 in 2026?

> PrestaShop 1.7 in 2026: since when it gets no patches, which published flaws affect it, the PHP 7.4 problem and what to do if your store is still on 1.7.

URL: https://webintacta.com/en/guides/is-prestashop-1-7-still-safe
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** No: PrestaShop 1.7 has not received security patches since June 10, 2025, when PrestaShop 9.0.0 came out and maintenance of the 1.7.8 branch ended; the last release is 1.7.8.11, from January 2024. It also runs on PHP 7.4 at most, unpatched since November 2022, and core flaws published since then (for example the critical CVE-2026-44212) have no fix for 1.7. The recommended path is to move to 8.2 and then to 9; in the meantime, up-to-date modules and file monitoring reduce the risk.


By Jose Soriano (WebIntacta) · published 2026-10-24

Many of the stores I review are still on PrestaShop 1.7 and work fine: they sell, the back office responds and nobody has noticed anything. Whether it is safe to carry on like that has a concrete answer, with dates, and it doesn't depend on opinions. Here are the facts from the PrestaShop project itself and from PHP, and what I would do with a 1.7 store depending on the case.

## The dates that matter

| Fact | Date | Source |
| --- | --- | --- |
| PrestaShop 8.0.0 is released and the 1.7.8 branch moves to critical and security fixes only | October 26, 2022 | Project announcement and GitHub releases |
| PHP 7.4, the highest version 1.7.8 supports, stops receiving security patches | November 28, 2022 | php.net |
| Last 1.7 release: 1.7.8.11 | January 2, 2024 | PrestaShop releases on GitHub |
| PrestaShop 9.0.0 is released and 1.7 maintenance ends | June 10, 2025 | Project announcement and GitHub releases |
| The 8.2 branch stays in extended support until PrestaShop 10.0.0 is released | In effect (October 2026) | PrestaShop project announcement |

Checked on October 17, 2026 against the sources at the end of the guide.

The project's announcement is blunt about it: the 1.7.8 maintenance period would end with the release of PrestaShop 9.0.0, and from that day on 1.7 would no longer be maintained. PrestaShop 9.0.0 was released on June 10, 2025.

## What “unsupported” means in practice

When someone discovers a flaw in the PrestaShop core, the project publishes an advisory with the affected versions and the ones that fix it. Since 2025, fixes come out for 8.2 and 9, not for 1.7. A real example: **CVE-2026-44212** (critical severity, 9.3), a stored XSS that lets an attacker with no account submit the contact form with a crafted email and take over the session of the employee who opens that message in the back office. The official advisory lists versions before 8.2.6 as affected and fixes it in 8.2.6 and 9.1.1; there is no 1.7 release with the fix.

- **Every new core advisory is a public manual** for attacking the stores that can't update. Besides CVE-2026-44212, other advisories published since September 2025 list every version before 8.2.x as affected, which includes 1.7: CVE-2026-33673 (stored XSS, high severity), CVE-2026-25597 and CVE-2025-51586 (finding out which email addresses have an account in the store). All of them are fixed only in 8.2 and 9.
- **PHP 7.4 gets no patches either**, since November 2022. A PHP flaw discovered now stays open on your server, and more and more hosts are retiring 7.4 or charging for it as extended support. It has already happened: the two critical [PHP2Shell](https://webintacta.com/en/guides/php2shell-vulnerability) flaws, published in October 2026, have no official fixed release for PHP 8.1 or earlier.
- **Third-party modules are dropping 1.7.** When the author fixes a flaw, they often publish only the version for 8 or 9. It is the most serious problem, because most PrestaShop intrusions come in through a module, not the core: I explain it in [vulnerable PrestaShop modules](https://webintacta.com/en/guides/vulnerable-prestashop-modules). It even happens with official modules: the critical flaw in [ps_facetedsearch](https://webintacta.com/en/guides/ps-facetedsearch-vulnerability), the filter module almost every store has, was fixed in 4.0.4, and the module's current branch is for PrestaShop 8.2 and later only.

## So, am I going to get hacked?

Not necessarily tomorrow, but the risk only grows. What decides whether a 1.7 store is exposed today is: which modules it has and in which version, whether there are files that shouldn't be there anymore (the `install` folder, `.zip` or `.sql` copies in the root, disabled modules still on the server), whether the back office is protected and whether someone is watching for file changes. I have seen well-kept 1.7 stores and version 8 stores with a skimmer in the checkout for months: the version is an important factor, not the only one.

A quick way to see where yours stands: the [free scan](https://webintacta.com/en/free-website-security-scan) detects from outside the version, visible modules with published flaws and exposed files, in a few minutes and with no sign-up.

## What to do if you are still on 1.7

1. **Plan the upgrade.** You can't go straight from 1.7 to 9 because no PHP version works for both: you move to 8.2 on PHP 7.4, raise PHP to 8.1 and then upgrade to 9. The steps are in [upgrade PrestaShop](https://webintacta.com/en/guides/upgrade-prestashop).
2. **Meanwhile, reduce the attack surface:** uninstall and delete the modules you don't use, update third-party modules to the latest version compatible with 1.7 and replace abandoned ones that have published flaws.
3. **Protect the back office:** an admin folder with a non-obvious name, reviewed employee accounts, long and unique passwords and, if your host allows it, access restricted by IP.
4. **Monitor file integrity and the checkout.** Finding out the next day that someone has modified `classes/Cart.php` or a payment module is the difference between a scare and months of stolen cards. The signs of a skimmer are in [credit card skimming in your store](https://webintacta.com/en/guides/credit-card-skimming-online-store).
5. **Off-server backups**, tested, in case you need to roll back.

> If you suspect the store is already compromised, don't upgrade on top of it: an upgrade doesn't remove a backdoor or a malicious override. First it gets reviewed and cleaned; the steps are in [PrestaShop hacked: what to do](https://webintacta.com/en/guides/prestashop-hacked-what-to-do).

## How I can help

I work with PrestaShop every day, from 1.6 to 9, and the read-only connector works on 1.7. The [PrestaShop security audit](https://webintacta.com/en/prestashop-security) (€169) checks your 1.7 store from the inside: core integrity file by file, modules cross-checked against published advisories, overrides and checkout. [PrestaShop maintenance](https://webintacta.com/en/prestashop-maintenance) (€69/month, no lock-in) keeps the store as protected as it can be while you prepare the jump, and the major-version migration is quoted separately, at a fixed price. Prices excluding VAT.

## Sources

- [PrestaShop: 1.7.8 in extended support phase](https://build.prestashop-project.org/news/2023/178-in-extended-support-phase/) (maintenance ends when 9.0.0 is released)
- [PrestaShop 1.7.8.11 on GitHub](https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.11) (last 1.7 release, January 2, 2024) and [PrestaShop 9.0.0](https://github.com/PrestaShop/PrestaShop/releases/tag/9.0.0) (June 10, 2025)
- [PrestaShop: 8.2.x in extended support phase](https://build.prestashop-project.org/news/2025/82x-extended-support-phase/)
- [Security advisory GHSA-w9f3-qc75-qgx9 (CVE-2026-44212)](https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-w9f3-qc75-qgx9) and [its NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-44212)
- [All PrestaShop core security advisories](https://github.com/PrestaShop/PrestaShop/security/advisories)
- [PrestaShop 1.7 system requirements](https://devdocs.prestashop-project.org/1.7/basics/installation/system-requirements/) (PHP up to 7.4 on 1.7.8)
- [PHP: unsupported branches](https://www.php.net/eol.php) (PHP 7.4, end of support November 28, 2022)

## Frequently asked questions

### Is PrestaShop 1.7 still supported?

No. Maintenance of the 1.7.8 branch ended when PrestaShop 9.0.0 was released, on June 10, 2025. The last 1.7 release is 1.7.8.11, from January 2024.

### Is PrestaShop 1.7.8.11 safe?

It is the safest 1.7 release, but it doesn't get the fixes published since: for example, CVE-2026-44212 (critical) was fixed in 8.2.6 and 9.1.1, not in 1.7. It also depends on PHP 7.4, which has had no patches since November 2022.

### Which PrestaShop versions are supported in 2026?

The 9 branch (9.2.0 came out on September 30, 2026) and 8.2, which is in extended support until PrestaShop 10.0.0 is released. Versions 1.6, 1.7, 8.0 and 8.1 no longer receive patches.

### Can I upgrade from PrestaShop 1.7 straight to 9?

In practice, no: 1.7.8 runs on PHP 7.4 at most and PrestaShop 9 needs PHP 8.1 or later. The usual path is to move to 8.2, raise PHP and then move to 9.

### How much does a security review of a PrestaShop 1.7 store cost?

The external scan is free. The security report for stores, with the read-only connector, costs €169 (excluding VAT) and is deducted if you then order a cleanup or maintenance.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos