# PrestaShop 1.7 and 8 in 2026: how much you risk by staying behind

Many PrestaShop stores still run on 1.7 or 8. They work, they sell, and the question "why should I touch something that works?" is fair. The problem is that "works" describes today, while the risks of an old version build up quietly: you don't see them until something happens.

In this article we lay out, without alarmism, what it concretely means to stay on an old PrestaShop version at the end of 2026, and how to tell whether your store is in the safe zone or in the one to fix soon.

PrestaShop 8: the problem isn't PrestaShop, it's PHP

PrestaShop 8 is still maintained: the 8.2 branch receives security fixes only, the latest being 8.2.8 of 18 August 2026. So far, no drama.

The weak spot sits one level below. The official documentation lists PrestaShop 8 support up to PHP 8.1, and PHP 8.1 left security support on 31 December 2025. In plain terms: a store on version 8 today necessarily runs on a PHP version that no longer gets fixes, even if PrestaShop itself is up to date. It's the same point we made about unsupported PHP: a vulnerability found tomorrow in PHP 8.1 will stay open.

There's a practical effect too: many hosts remove unsupported PHP versions from their control panels. The day the host forces a newer version, a store on 8 may simply stop working.

PrestaShop 1.7: frozen for years

Version 1.7 has been in extended support since October 2022, and its latest published fix dates from 2024. It runs on even older PHP versions, all long out of support. A store on 1.7 in 2026 has piled up years of missing fixes, in the core and almost always in the modules too.

No need to imagine theoretical scenarios. In July 2022 PrestaShop reported a real attack against stores on old versions: an SQL injection vulnerability (a way to make the database run commands it shouldn't) was used to add a fake payment module to the checkout that sent card details to the attackers. Up-to-date versions with up-to-date modules were not vulnerable. How to recognise an attack like that is covered in hacked PrestaShop.

The real risk is in the modules

Even with an up-to-date core, the store is as secure as the oldest module it has installed. Modules bought years ago and never updated, modules from vendors that closed down, custom modules written by someone who is no longer around: they're the most common way in, because nobody keeps an eye on them. And they're also the reason upgrades get postponed, because "the management software module doesn't work with the new version".

It's a vicious circle: the old module blocks the upgrade, the missed upgrade leaves the store exposed, and time makes the jump ever bigger. We go into detail in the article on moving to PrestaShop 9.

It's not just a technical matter

An online store handles personal data and, directly or through the payment provider, payment data. GDPR requires security measures appropriate to the state of the art, and software without fixes for years hardly qualifies; if there's a personal data breach, the authority must be notified within 72 hours of becoming aware of it. Those working with larger companies are also starting to get supplier questions tied to the NIS2 directive: "which versions do you use, how do you update them?".

How to decide when to upgrade

A simple rule to see where you stand:

• Up-to-date PrestaShop 9: you're fine, just keep core and modules on the latest releases.
• Up-to-date PrestaShop 8.2: the core is covered, PHP isn't. Plan the move to 9 in the coming months, without rushing but without postponing forever.
• PrestaShop 8.0, 8.1 or 1.7: you're behind on several fronts. First a security check, then an upgrade plan.
• You don't know your version: that's the first problem to solve. The number is in the back office, at the bottom or on the Information page.

If you want a full snapshot before deciding, the store check-up lines up version, modules, security and backups with priorities and costs. And a side benefit often shows up too: newer PHP versions are faster, one of the points we covered when discussing slow PrestaShop.

In short

Staying on PrestaShop 1.7 or 8 in 2026 doesn't mean you've already been attacked, but it does mean running on unsupported PHP versions and, almost always, on modules nobody updates any more. 8.2 still gets security fixes, 1.7 hasn't for years. The risk doesn't go away by waiting: it grows, along with the cost of the jump. It pays to know where you stand, pick a date and get there with a plan.

Sources

• PrestaShop 8.2.8 security release - PrestaShop Project, 18 August 2026
• PrestaShop 1.7.8.8 maintenance release - PrestaShop Project, October 2022
• PrestaShop 1.7.8.11 maintenance release - PrestaShop Project, 2024
• System requirements - PrestaShop 8 - official documentation
• Unsupported Branches - php.net, end-of-life dates for PHP versions
• Major security vulnerability on PrestaShop websites - PrestaShop Project, July 2022