Low 3.8 CVSS 3.1 ps_checkout Component: back office Published on 2025-10-16

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal.

CVECVE-2025-61924 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-10-09

Description

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security-advisories@github.com · secondary

Low 3.8

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack vectorNetwork

ComplexityLow

Privileges requiredHigh

User interactionNone

ScopeUnchanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

References

Vendor Advisorygithub.com
https://github.com/PrestaShopCorp/ps_checkout/security/advisories/GHSA-wvpg-4wrh-5889

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: ps_checkout

All ps_checkout advisories (3)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2025-61923 PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. ps_checkout Medium 4.1 < 4.4.1
≥ 5.0.0 < 5.0.5 2025-10-16 Yes

CVE-2025-61922 PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. ps_checkout Critical 9.1 ≥ 1.3.0 < 4.4.1
≥ 5.0.0 < 5.0.5 2025-10-16 Yes

Do you use the ps_checkout module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected