CVE-2025-61924CWE-184

CVE-2025-61924

Low · published October 16, 2025

CVSS v3.1
3.8
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Weakness
CWE-184 · Incomplete List of Disallowed Inputs
Published
2025-10-16T22:15Z
Affected products (5)
ProductVersionsFixed in
prestashop/prestashop_checkout< 7.4.4.17.4.4.1
prestashop/prestashop_checkout≥ 7.5.0.1, < 7.5.0.57.5.0.5
prestashop/prestashop_checkout≥ 8.3.1.0, < 8.4.4.18.4.4.1
prestashop/prestashop_checkout≥ 8.5.0.0, < 8.5.0.58.5.0.5
prestashop/prestashop_checkout≥ 9.4.3.1, < 9.5.0.59.5.0.5
References (1)
https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-wvpg-4wrh-5889 · [email protected]
EPSS history
Timeline
  • 16 OCT 17:33Z
    PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
    cvelistv5