Report

Should I Use Amasty?

amasty.com·Analyzed 1 day ago·9/18/2026·Based on 9 sources

Magento 2 extension vendor

Depends

Worth buying if you run Magento 2 and need a specific feature, with a developer who applies security patches fast.

Magento-only extension powerhouse with a huge catalog — but a public RCE exploit and 25-extension patch wave demand fast patching.

Confidence: Medium

4.3/5

Trustpilot

627 reviews

3.4/5

G2 vendor rating

7 reviews

~$20M

Revenue

Owler estimate

Bootstrapped

Funding

No outside investment

Value for money

Reddit users call pricing a 'money grab'

Feature depth

Vast catalog: checkout, SEO, security, segmentation

Support quality

Trustpilot 4.3/627 positive; Reddit reports mixed

Security posture

RCE CVE plus 25-extension mass patch release

Pros

Huge catalog of Magento 2 extensions across sales, UX, and admin^¹
Established Adobe Commerce vendor, ~$20M revenue, no debt to investors^⁸
Trustpilot 4.3/5 across 627 reviews^²
Does patch disclosed vulnerabilities — 25 extensions fixed in one release^⁴
Moving Hyvä-first for faster storefronts

Cons

CVE-2026-53787: unauthenticated file upload leading to remote code execution^⁵
Fully weaponized public exploit for that RCE exists^⁶
Mass patch release across 25 extensions, 2 rated critical^⁴
Community complaints about pricing becoming a 'money grab'^⁷
G2 vendor rating is only 3.4/5^³

Gotchas

highPublic weaponized exploit for Order Attributes RCE — patch immediately or risk store compromise^⁶
mediumRenewal fees and aggressive upsells; Reddit calls recent pricing moves a 'money grab'^⁷
mediumCompatibility issues reported; Custom Forms allegedly fails to trigger Trustpilot AFS
lowCommunity sentiment on extension vendors is mixed — vet each module separately before buying

Best for

Mid-market Magento 2 stores
Stores needing niche checkout or SEO features
Adobe Commerce teams with dev resources
Hyvä-theme adopters

Not for

Shopify or WooCommerce stores — this is Magento-only
Solo merchants with no Magento developer on call
Teams that won't patch extensions within days of disclosure
Buyers sensitive to aggressive renewal and upsell pricing

Security

Recent critical findings: unauthenticated RCE (CVE-2026-53787) in Order Attributes and a mass patch release across 25 extensions; vendor is patching actively.

CVE-2026-53787 — Unauthenticated arbitrary file upload / RCE in Order AttributesUnauthenticated file upload in versions below 4.0.0 enables remote code execution; a weaponized exploit is publicly available.^⁵
Mass security patch release across the extension catalogAmasty patched 25 extensions after coordinated disclosures; 2 issues were rated critical.^⁴