GHSA-wvpg-4wrh-5889LowCVSS 3.8

PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

Published
October 16, 2025
Last Modified
October 16, 2025

🔗 CVE IDs covered (1)

CVE-2025-61924 →

📋 Description

Impact

Wrong usage of the PHP array_search() allows bypass of validation.

Patches

The problem has been patched in versions:

  • v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1)
  • v4.4.1 for PrestaShop 8 (build number: 8.4.4.1)
  • v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5)
  • v5.0.5 for PrestaShop 8 (build number: 8.5.0.5)
  • v5.0.5 for PrestaShop 9 (build number: 9.5.0.5)

Read the Versioning policy to learn more about the build number.

Credits

Léo CUNÉAZ reported this issue.

🎯 Affected products2

  • composer/prestashop/ps_checkout:< 4.4.1
  • composer/prestashop/ps_checkout:>= 5.0.0, < 5.0.5

🔗 References (3)