CVE-2025-61922

Published Oct 16, 2025

Last updated 2 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-61922 affects the PrestaShop Checkout module, which is the official payment module in partnership with PayPal. The vulnerability exists in versions 1.3.0 and prior to 4.4.1 and 5.0.5. It stems from a missing validation on the Express Checkout feature, which allows silent login, potentially leading to account takeover via email. This vulnerability allows attackers to perform unauthorized account takeovers by bypassing authentication in the Express Checkout feature. By exploiting this, attackers can silently log in to existing customer accounts using only an email address, which could compromise user data and account security. The vulnerability has been fixed in versions 4.4.1 and 5.0.5.

Description: PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent login, enabling account takeover via email. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Source: security-advisories@github.com
NVD status: Analyzed
Products: prestashop_checkout

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.1
Impact score: 5.2
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-287

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*",
            "vulnerable": true,
            "matchCriteriaId": "78BDECB6-6142-47A0-89D1-C96DE8B052EB",
            "versionEndExcluding": "7.4.4.1",
            "versionStartIncluding": "1.3.0"
          },
          {
            "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*",
            "vulnerable": true,
            "matchCriteriaId": "36D48F64-2C0D-4DF7-9FBB-26FF21B9C71B",
            "versionEndExcluding": "7.5.0.5",
            "versionStartIncluding": "7.5.0.1"
          },
          {
            "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*",
            "vulnerable": true,
            "matchCriteriaId": "78BB8AD6-68E4-426F-B9D9-1810D37193D4",
            "versionEndExcluding": "8.4.4.1",
            "versionStartIncluding": "8.3.1.0"
          },
          {
            "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CF84DA7C-A801-4366-8463-F6FD21A69263",
            "versionEndExcluding": "8.5.0.5",
            "versionStartIncluding": "8.5.0.0"
          },
          {
            "criteria": "cpe:2.3:a:prestashop:prestashop_checkout:*:*:*:*:*:prestashop:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FBB531A1-D85B-4987-89FB-EC28C974301F",
            "versionEndExcluding": "9.5.0.5",
            "versionStartIncluding": "9.4.3.1"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.