CVE-2025-61922
CVE-2025-61922 · PrestaShop Checkout allows customer account takeover via email
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
CVSS 9.1 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
ps_checkout
- Versions
- >= 1.3.0, < 4.4.1: Affected
- >= 5.0.0, < 5.0.5: Affected
No fix published
prestashop/ps_checkout Packagist
- Versions
- v1.3.0
- v1.4.0
- v1.4.1
- v1.5.0
- v1.5.1
- v1.5.2
- v2.0.0
- v2.0.1
- v2.0.2
- v2.0.3
- v2.0.4
- v2.0.5
- v2.0.7
- v2.0.8
- v2.1.0
- v2.10.0
- v2.11.0
- v2.12.0
- v2.12.1
- v2.13.0
- v2.14.0
- v2.15.0
- v2.15.1
- v2.15.2
- v2.15.3
- v2.15.4
- v2.15.5
- v2.16.0
- v2.17.0
- v2.17.1
- v2.18.0
- v2.18.1
- v2.19.0
- v2.2.0
- v2.20.0
- v2.20.1
- v2.20.2
- v2.21.0
- v2.3.0
- v2.4.0
- v2.5.0
- v2.5.1
- v2.5.2
- v2.6.0
- v2.7.0
- v2.7.1
- v2.8.0
- v2.9.0
- v3.0.0
- v3.0.1
- v3.0.2
- Affected ranges
- ECOSYSTEM: ≥ 1.3.0, < 4.4.1
Update to 4.4.1
prestashop/ps_checkout Packagist
- Versions
- v5.0.1
- v5.0.2
- v5.0.3
- v5.0.4
- v5.0.4-beta1
- v5.0.4-beta10
- v5.0.4-beta2
- v5.0.4-beta3
- v5.0.4-beta4
- v5.0.4-beta5
- v5.0.4-beta6
- v5.0.4-beta7
- v5.0.4-beta8
- v5.0.4-beta9
- Affected ranges
- ECOSYSTEM: ≥ 5.0.0, < 5.0.5
Update to 5.0.5