CVE-2025-61922
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
PrestaShop Checkout versions starting from 1.3.0 and prior to 4.4.1 and 5.0.5 have missing validation on the Express Checkout feature, allowing silent login and account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Risk Assessment
An attacker could take over a user's account without their knowledge, gaining access to personal data, order history, and payment methods. This may lead to fraud and breach of customer privacy.
Recommendation
Immediately update the PrestaShop Checkout module to version 4.4.1 or 5.0.5 (or later). No workarounds are available, so updating is the only solution.
Other vulnerabilities in PrestaShop Checkout
See all- CVE-2025-61924Low
PrestaShop Checkout (versions prior to 4.4.1 and 5.0.5) contains a vulnerability allowing hijacking of the target PayPal merchant account from the backoffice due to incorrect usage of the PHP array_search() function. The flaw is fixed in versions 4.4.1 and 5.0.5.
- CVE-2025-61923Medium
PrestaShop Checkout versions prior to 4.4.1 and 5.0.5 lack input validation in the backoffice, resulting in directory traversal and arbitrary file disclosure. Fixed in versions 4.4.1 and 5.0.5.
Original NVD description (English source)
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS