by Kastro
Paper/Archive/CVE-2025-61922

CVE-2025-61922

PrestaShopCorp ps_checkout — PrestaShop Checkout allows customer account takeover via email

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 43.0.430 × 208.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Affected

ProductAffectedFixed inSource
ps_checkout>= 1.3.0, < 4.4.1–CNA
ps_checkout>= 5.0.0, < 5.0.5–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-54hq-mf6h-48xh