CVE-2025-61924
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
PrestaShop Checkout (versions prior to 4.4.1 and 5.0.5) contains a vulnerability allowing hijacking of the target PayPal merchant account from the backoffice due to incorrect usage of the PHP array_search() function. The flaw is fixed in versions 4.4.1 and 5.0.5.
Risk Assessment
An attacker with backoffice access can hijack the PayPal merchant account, potentially leading to unauthorized financial transactions. Organizations using PrestaShop Checkout are at risk of significant financial loss.
Recommendation
Immediately update PrestaShop Checkout to version 4.4.1 or 5.0.5. No known workarounds exist.
Other vulnerabilities in PrestaShop Checkout
See all- CVE-2025-61922Critical
PrestaShop Checkout versions starting from 1.3.0 and prior to 4.4.1 and 5.0.5 have missing validation on the Express Checkout feature, allowing silent login and account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
- CVE-2025-61923Medium
PrestaShop Checkout versions prior to 4.4.1 and 5.0.5 lack input validation in the backoffice, resulting in directory traversal and arbitrary file disclosure. Fixed in versions 4.4.1 and 5.0.5.
Original NVD description (English source)
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS