PT-2025-42514 · Unknown · Prestashop Checkout

Inem0O

·

Published

2025-10-16

·

Updated

2026-02-17

·

CVE-2025-61922

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions PrestaShop Checkout versions 1.3.0 through 4.4.0 PrestaShop Checkout versions 5.0.0 through 5.0.4
Description The PrestaShop Checkout module, used in partnership with PayPal, contains a flaw in the Express Checkout feature. Missing validation allows for silent login, potentially enabling account takeover via email. This issue affects versions starting from 1.3.0. There are reports of a zero-click account takeover vulnerability. The vulnerability allows attackers to bypass authentication entirely, gaining unauthorized access to customer accounts.
Recommendations Update to PrestaShop Checkout version 4.4.1 for PrestaShop 1.7 (build number 7.4.4.1). Update to PrestaShop Checkout version 4.4.1 for PrestaShop 8 (build number 8.4.4.1). Update to PrestaShop Checkout version 5.0.5 for PrestaShop 1.7 (build number 7.5.0.5). Update to PrestaShop Checkout version 5.0.5 for PrestaShop 8 (build number 8.5.0.5). Update to PrestaShop Checkout version 5.0.5 for PrestaShop 9 (build number 9.5.0.5).

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-61922
GHSA-54HQ-MF6H-48XH

Affected Products

Prestashop Checkout