Blog
- Details
Five more plugins have arrived on the marketplace since our last round-up, four of them free, one putting your products in your customers' living rooms, and the plugin which draws your PDF invoices has been rebuilt on a maintained library. Here is what is new, and what changed under you.
Everything below is on the marketplace.
- Details
HikaShop 6.6.0 gives your shop a mobile application. It is free, it runs your shop from your phone, and you connect it by scanning a QR code. It rests on a real API, which anything else you write can use too. The release also puts the whole checkout on a product page, rebuilds the affiliate page your partners see, brings HikaShop to the command line, adds several languages to a WordPress shop, imports your categories, and draws every graph itself instead of asking Google. It also fixes a security issue in the Bambora (Beanstream) payment plugin. In total this release brings 12 new features, 44 improvements, and 86 bug fixes.
Here is a look at the highlights of this release.
- Details
HikaShop 6.6.0 fixes a high severity vulnerability in the Bambora (Beanstream) payment plugin shipped with HikaShop, reported to us through the Joomla security team. On the shops concerned, someone who knew the id of an order could have that order marked as paid without any payment having been made.
Here is what the issue was, how to know whether your shop is concerned, and what to do.
- Details
Five new plugins have arrived on the marketplace this summer, and a good number of the ones you already use have been updated. Here is what is new, and what changed under you.
Everything below is on the marketplace.
- Details
HikaShop 6.5.2 is a maintenance release. It fixes a security issue along with several bugs, and we recommend that all merchants update.
Security fix: open redirect in the currency switcher
We fixed a medium severity open redirect vulnerability in the currency switcher. When a visitor changed the currency, HikaShop could send them back to an address passed in the link. A specially crafted link, using a doubly encoded web address, could get past the safety check and send the visitor to an external website instead of back to your shop.
This kind of flaw does not expose any data by itself, but it can be abused in phishing: an attacker sends a link that starts on your genuine domain and then bounces the visitor to a look-alike site. The visitor sees your address at first and is more easily fooled.
Affected versions: all editions of HikaShop (Starter, Essential and Business), from the earliest versions up to and including 6.5.1. The issue is fixed in 6.5.2, released today, the 20th of July 2026.
The address a visitor is sent back to is now fully decoded and checked before the redirection, so only addresses on your own site are accepted.
Update recommended
Because this fix concerns security, we advise every merchant to update to 6.5.2 as soon as possible, using the one click updater in your back-end or the package from your member area.
HikaShop 6.5.2 also includes a number of other bug fixes. You can see the full list in the change log.
If you cannot update right away
If you are on an older version and cannot update to 6.5.2 immediately, you can apply the security fix by hand. Open the front-end currency controller, the file components/com_hikashop/controllers/currency.php, and find these two lines:
if(hikashop_disallowUrlRedirect($url)) return false; $app->redirect(urldecode($url));
Replace them with:
$url = urldecode($url); if(hikashop_disallowUrlRedirect($url)) return false; $app->redirect($url);
The same two lines are also present in the back-end controller, administrator/components/com_hikashop/controllers/currency.php; apply the same change there. This decodes the return address first and then checks the exact address the visitor will be sent to, so the safety check can no longer be bypassed. Clear your Joomla cache afterwards.