CVE-2025-61922: PrestaShop Checkout allows customer account takeover via email

Description

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 43% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PS

ps_checkout · PrestaShopCorp

>= 1.3.0, < 4.4.1; >= 5.0.0, < 5.0.5 · source: vendor

PC

Prestashop Checkout · Prestashop

1.3.0 before 7.4.4.1; 7.5.0.1 before 7.5.0.5; 8.3.1.0 before 8.4.4.1; 8.5.0.0 before 8.5.0.5; 9.4.3.1 before 9.5.0.5 · source: NVD