CVE-2025-61922

Published: Oct 16, 2025Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Affected (5)

Products: Prestashop: Prestashop Checkout

Prestashop

1 product

Prestashop Checkout

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Prestashop Prestashop Checkout	From 1.3.0 to 7.4.4.1
Prestashop Prestashop Checkout	From 7.5.0.1 to 7.5.0.5
Prestashop Prestashop Checkout	From 8.3.1.0 to 8.4.4.1
Prestashop Prestashop Checkout	From 8.5.0.0 to 8.5.0.5
Prestashop Prestashop Checkout	From 9.4.3.1 to 9.5.0.5

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (1)

https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-54hq-mf6h-48xh

Source: security-advisories@github.com

PatchVendor Advisory

Timeline

No history available yet.