GHSA-54hq-mf6h-48xhCriticalCVSS 9.1

PrestaShop Checkout allows customer account takeover via email

Published
October 16, 2025
Last Modified
October 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-61922 →

📋 Description

Impact

Missing validation on Express Checkout feature allows silent log-in

Affected versions

The issue was introduced in PrestaShop Checkout 1.3.0 .

All versions above 1.3.0 are vulnerable except of course the patch versions published on 16/10/2025: 7.4.4.1, 8.4.4.1, 7.5.0.5, 8.5.0.5, 9.5.0.5

Patches

The problem has been patched in versions

  • v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
  • v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
  • v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
  • v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
  • v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read our Versioning policy to learn more about our build numbers and versions of PrestaShop Checkout

Credits

We would like to thank Léo CUNÉAZ for reporting the issue.

🎯 Affected products2

  • composer/prestashop/ps_checkout:>= 5.0.0, < 5.0.5
  • composer/prestashop/ps_checkout:>= 1.3.0, < 4.4.1

🔗 References (3)