Yes - it's likely a session problem .... but more specifically it's an advertising problem.
If the customer is coming to your site via a link that contains a zenid parameter, then everyone who comes to that link will share their information.
The key is to NOT post links that contain the zenid parameter. This means emails, advertising, everything.
In the newer versions of Zen Cart there have been some improvements to the Session Recreate logic which will dump the existing zenid during login and build a new one. You could try flipping that switch on in your current version, but I have no idea if it will help much or not. I suggest upgrading either way.
Admin->Configuration->Sessions->"Session Recreate" --- set to True.
Don't touch anything else in there.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.
