CVE-2025-61924lowCWE-184

CVE-2025-61924: low-severity vulnerability in PrestaShopCorp ps_checkout

PrestaShop Checkout Target PayPal merchant account hijacking from backoffice

Published

Follow this CVE+ Monitor ps checkout+ Monitor prestashop/ps_checkout

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.8epss 0.3%
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the Target PayPal merchant account hijacking from backoffice due to wrong usage of the PHP array_search(). The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected products
PrestaShopCorp · ps_checkout
Related CVEs — PrestaShopCorp ps_checkout

In the same product, most dangerous first.

CVE-2025-61923MEDIUMPrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosureEPSS 0.9%CVE-2025-61922CRITICALPrestaShop Checkout allows customer account takeover via emailEPSS 0.5%