CVE-2025-61924: PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

Description

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 19% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PS

ps_checkout · PrestaShopCorp

< 4.4.1; >= 5.0.0, < 5.0.5 · source: vendor

PC

Prestashop Checkout · Prestashop

before 7.4.4.1; 7.5.0.1 before 7.5.0.5; 8.3.1.0 before 8.4.4.1; 8.5.0.0 before 8.5.0.5; 9.4.3.1 before 9.5.0.5 · source: NVD