CVE-2025-61922

CriticalCVSS 9.1

Published: 16/10/2025(UTC)Updated: 09/10/2026(UTC)Translated: 09/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

41th percentile - higher than 41% of all known CVEs

Summary

PrestaShop Checkout versions starting from 1.3.0 and prior to 4.4.1 and 5.0.5 have missing validation on the Express Checkout feature, allowing silent login and account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Risk Assessment

An attacker could take over a user's account without their knowledge, gaining access to personal data, order history, and payment methods. This may lead to fraud and breach of customer privacy.

Recommendation

Immediately update the PrestaShop Checkout module to version 4.4.1 or 5.0.5 (or later). No workarounds are available, so updating is the only solution.

Other vulnerabilities in PrestaShop Checkout

CVE-2025-61923Medium
PrestaShop Checkout versions prior to 4.4.1 and 5.0.5 lack input validation in the backoffice, resulting in directory traversal and arbitrary file disclosure. Fixed in versions 4.4.1 and 5.0.5.

Original NVD description (English source)

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS