GitHub Advisoryadvisory · Packagist

GHSA-wvpg-4wrh-5889 PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

LOW Published 2025-10-16 Modified 2025-10-16 Official page ↗
Aliases
CVE-2025-61924
Ecosystem
Packagist
Packages
prestashop/ps_checkout
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-184
Reviewed
2025-10-16

Affected packages

• Packagist prestashop/ps_checkout: < 4.4.1 → fixed in 4.4.1 • Packagist prestashop/ps_checkout: >= 5.0.0, < 5.0.5 → fixed in 5.0.5

Description

Impact Wrong usage of the PHP `array_search()` allows bypass of validation. Patches The problem has been patched in versions: • v4.4.1 for PrestaShop 1.7 (build number: 7.4.4.1) • v4.4.1 for PrestaShop 8 (build number: 8.4.4.1) • v5.0.5 for PrestaShop 1.7 (build number: 7.5.0.5) • v5.0.5 for PrestaShop 8 (build number: 8.5.0.5) • v5.0.5 for PrestaShop 9 (build number: 9.5.0.5) Read the Versioning policy to learn more about the build number. Credits Léo CUNÉAZ reported this issue.

Related

Alias · CVE (1)

  • CVE-2025-61924 PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. vulnerability

Weakness · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

References