Critical · published October 16, 2025
🚨 A missing validation in PrestaShop's Checkout module lets attackers silently log in as users—like a waiter serving food without confirming the order! 🔥 Think of it as a restaurant where anyone can walk in and claim a meal without showing a reservation. In this case, the missing validation means bad actors can sneak in and take over accounts using just an email address. This vulnerability could lead to account takeovers, giving attackers the ability to hijack user accounts and access sensitive payment information. Imagine a thief slipping into your online store, changing details, and causing chaos—absolutely devastating!
Think of it as a restaurant where anyone can walk in and claim a meal without showing a reservation. In this case, the missing validation means bad actors can sneak in and take over accounts using just an email address. This vulnerability in PrestaShop Checkout allows silent login through the Express Checkout feature due to missing validation, enabling potential attackers to take over accounts by simply providing an email address.
This vulnerability could lead to account takeovers, giving attackers the ability to hijack user accounts and access sensitive payment information. Imagine a thief slipping into your online store, changing details, and causing chaos—absolutely devastating! Upgrade PrestaShop Checkout to versions 4.4.1 or 5.0.5 immediately to patch this vulnerability. Since there are no known workarounds, timely action is critical to protect your users from account takeovers. You've got this! Follow these steps, and you’ll be a security hero in no time! 🦸♂️
| Product | Versions | Fixed in |
|---|---|---|
| prestashop/prestashop_checkout | ≥ 1.3.0, < 7.4.4.1 | 7.4.4.1 |
| prestashop/prestashop_checkout | ≥ 7.5.0.1, < 7.5.0.5 | 7.5.0.5 |
| prestashop/prestashop_checkout | ≥ 8.3.1.0, < 8.4.4.1 | 8.4.4.1 |
| prestashop/prestashop_checkout | ≥ 8.5.0.0, < 8.5.0.5 | 8.5.0.5 |
| prestashop/prestashop_checkout | ≥ 9.4.3.1, < 9.5.0.5 | 9.5.0.5 |